community-automations/security-auditor

DevOps & Code

PublicClaude subagent

Security Auditor

Security scanners produce a long list once and then get ignored because nobody has time to sort signal from noise. This auditor runs weekly and acts on what it finds.

sonnet1 weekTrivyCheckovGitHubSlack
ClaudeClaude
ROI for
README.md

Why this subagent

Security scanners produce a long list once and then get ignored because nobody has time to sort signal from noise. This auditor runs weekly and acts on what it finds.

It scans dependencies and infrastructure code, ranks findings by severity and real exploitability, and drafts a fix for each high-priority issue. You get prioritized pull requests and a short summary of what needs sign-off, so the backlog shrinks instead of growing into a report nobody reads.

How it runs

    • Read

      Used at step 01 to kick off the pipeline.

    • Write

      Used at step 01 to kick off the pipeline.

    • WebFetch

      Used at step 01 to kick off the pipeline.

    • WebSearch

      Used at step 01 to kick off the pipeline.

Sample output

json
// Sample output
// (generated when the pipeline finishes)

Given weekly SCA and IaC scan results, return a ranked findings list with a drafted fix PR for each high-priority issue and a sign-off summary.

Unlock the rest

The full agent definition, install snippet, and starter task are gated for community members.

Members get the full `.md` agent file, the npm / pnpm install one-liners, a starter prompt that we've tuned against real runs, and the open-source repo when this automation ships there. One email, magic link, done.