Security Codex plugins

Publisher description

…eams that want the reasoning without writing the prompts, Orca maintains the AI Skills Hub, an open-source GitHub repo of agent skills. Type "triage alert orca-9012345" and the orca-alert-triage skill handles retrieval, analysis, and formatting. Teams can fork it, modify it, and extend it to their own use cases. The result: security and engineering teams work across cloud, code, and AI from a single workspace, with Orca's reasoning behind every answer.

Publisher full description

…h dependencies in this package-lock.json should I fix first?". CVE Risk Check reads two free public sources. The National Vulnerability Database (NVD) gives the description, the CVSS score and severity, the publication date, a link to a patch or vendor advisory when one is tagged, and whether the CI… …ithout a key, so records are cached for a few hours; a recent change to a CVE can take that long to appear, and when NVD asks this service to slow down the answer says so and when to retry. For a dependency list, pass the text of a lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock, poetry.lock,… …lowed by a short list of the rest. A match is by exact name and version: it does not show that your code reaches the vulnerable code. It does not scan your systems, read your source code, confirm that you are vulnerable, or tell you how to exploit anything. The CVE ids and dependency lists you send…

Publisher full description

…ing security checks and collect evidence linked to the relevant tests. Review a proposed fix before applying it, then re-run the check to verify the result. Draft security policies from your recorded answers and open direct browser links to review controls, tests, policies, risks and evidence. After… …gning in to Screenata and selecting a workspace, assess selected cloud accounts, identity services, code repositories and a local repository. New users create their account in the browser. Cloud checks run on Screenata servers with account-specific consent; provider credentials stay out of chat and tool arguments, and repository source stays local. Fix availability depends on the check and permissions, policies need human approval, and baseline scores are separate from audit readiness. Your auditor issues the report or certif…

Publisher description

VIDOC Security Review by Vidoc Security Lab: review source code for security issues, validate suspected findings, and prepare reports with supporting evidence using three defined skills.