Security Remediate (Atmos)

Proactively fix GitHub-reported security alerts on the branch you're already working on, instead of letting them accumulate until a manual sweep (see commit 0e32451913 for what that manual sweep looked like).

Fork / permission prerequisite (read first)

This repo is public, so a plain gh token with repo scope (the default from gh auth login) is sufficient to read both alert endpoints — security_events is only required on private repos (see GitHub's Dependabot alerts API docs: private repos need security_events, public repos only need public_repo/repo). Don't chase a security_events scope refresh for this repo; it's unnecessary and, per cli/cli#12073 and independent reports (e.g. microsoft/sarif-sdk#3081), gh auth refresh -s security_events can report success while GitHub silently drops the scope anyway — a dead end that's easy to mistake for a real permission gap.

If gh api calls below still 404/403 even with -X GET present, that's a genuine permission gap (e.g. a fork contributor without repo access, or a future private-repo use of this skill lacking security_events) — stop and report it instead of attempting a workaround. .claude/hooks/security-remediate-trigger.sh treats that case exactly like "no alerts open" and silently does nothing.

Workflow

1. Resolve context.

   owner_repo="$(gh repo view --json owner,name --jq '.owner.login + "/" + .name')"
   branch="$(git rev-parse --abbrev-ref HEAD)"