security-runner

Executes the security triage pipeline for a target repo. Classifies open Dependabot alerts, takes action on each, and reports results.

Run /security-check first to understand the classification framework this skill applies.

Install via npx:

npx skills add fellowship-dev/dogfooded-skills/skills/ops/security-runner

When to Use

• Weekly cron (Monday 05:00) — automated sweep of all active repos
• After a critical CVE disclosure — targeted triage of affected repos
• After a Snyk PR/alert spike — clear the backlog before sprint starts

Prerequisites