{"id":51753412,"url":"https://github.com/fortify/skills","last_synced_at":"2026-07-19T03:41:41.224Z","repository":{"id":358904454,"uuid":"1218375755","full_name":"fortify/skills","owner":"fortify","description":"AI agent skills for OpenText Fortify — SAST/DAST/SCA scanning, vulnerability triage, CI/CD integration, and FCLI workflows. Works with Claude Code, Codex, Gemini CLI, GitHub Copilot, and more.","archived":false,"fork":false,"pushed_at":"2026-07-01T00:20:32.000Z","size":557,"stargazers_count":11,"open_issues_count":3,"forks_count":1,"subscribers_count":2,"default_branch":"main","last_synced_at":"2026-07-01T01:16:33.407Z","etag":null,"topics":["agent-skills","appsec","claude-code","dast","gemini-cli-extension","github-copilot","openai-codex","sast","security","software-composition-analysis"],"latest_commit_sha":null,"homepage":"https://www.opentext.com/products/application-security","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/fortify.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-04-22T20:14:54.000Z","updated_at":"2026-06-30T05:22:44.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/fortify/skills","commit_stats":null,"previous_names":["fortify/skills"],"tags_count":4,"template":false,"template_full_name":null,"purl":"pkg:github/fortify/skills","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fortify%2Fskills","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fortify%2Fskills/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fortify%2Fskills/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fortify%2Fskills/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/fortify","download_url":"https://codeload.github.com/fortify/skills/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fortify%2Fskills/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35640427,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-19T02:00:06.923Z","response_time":112,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["agent-skills","appsec","claude-code","dast","gemini-cli-extension","github-copilot","openai-codex","sast","security","software-composition-analysis"],"created_at":"2026-07-19T03:41:40.464Z","updated_at":"2026-07-19T03:41:41.213Z","avatar_url":"https://github.com/fortify.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# OpenText Fortify Skills\n\nAI agent skills that teach Claude, GitHub Copilot and other AI agents how to use [OpenText Fortify](https://www.opentext.com/products/application-security) effectively — covering SAST/DAST/SCA scanning, vulnerability triage, audit workflows, CI/CD integration, FCLI commands and more.\n\n## Skills\n\n| Skill | Description |\n|-------|-------------|\n| **fortify-fod** | Fortify on Demand (SaaS) — applications, releases, scans, issues, OSS analysis, portfolio reporting |\n| **fortify-ssc** | Software Security Center (on-premise) — manage application versions, artifacts, scan jobs, issue triage |\n| **fortify-remediate** | Fix SAST and DAST vulnerabilities detected by Fortify; Aviator AI remediation |\n| **fortify-dependency-upgrade** | Remediate SCA / open source findings (vulnerable dependencies, CVEs) by upgrading versions and fixing resulting breakage |\n| **fortify-change-review** | Detect common, high impact security issues in code as it is being generated |\n| **fortify-create-app** | Create new Fortify applications in FoD or SSC — guided onboarding with validation and defaults |\n| **fortify-cicd-integration** | Add Fortify scanning to CI/CD pipelines — GitHub Actions, GitLab CI, Azure DevOps, Jenkins |\n| **fcli-common** | Fortify CLI (fcli) — installation, authentication, output formats, SpEL queries, custom actions |\n\n\n## Agents\n\nAgents are multi-skill orchestrators that handle end-to-end workflows.\n\n| Agent | Description |\n|-------|-------------|\n| **fortify-onboarding** | Onboard new applications into Fortify (FoD or SSC) — creates the app, configures settings, and optionally sets up CI/CD scanning pipelines. Handles single repos, bulk lists, or entire GitHub/GitLab/Azure DevOps organizations |\n\n## Prerequisites\n\n- **fcli** installed and on your PATH — [install instructions](skills/fcli-common/references/fcli-install.md)\n- An active Fortify on Demand (FoD) or Software Security Center (SSC) account\n- An AI assistant that supports Agent Skills (Claude Code, GitHub Copilot, Cursor, Gemini CLI, etc.)\n\n## Installation\n\n### Claude Code\n\nAdd the marketplace from GitHub, then install the plugin:\n\n```bash\nclaude plugin marketplace add fortify/skills\nclaude plugin install fortify-skills@fortify\n```\n\nThe plugin registers all nine skills and the onboarding agent automatically.\n\n### GitHub Copilot\n\n**Recommended: install the [Fortify Code Security](https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-code-security) VS Code extension.** It bundles all Fortify skills, can automatically install fcli, and adds full IDE integration (scanning, vulnerability review, Aviator AI remediation, and an optional fcli MCP server):\n\n1. Open VS Code and search for **Fortify Code Security** in the Extensions panel, or install directly:\n   ```\n   ext install fortifyvsts.fortify-code-security\n   ```\n2. The extension registers all skills automatically and sets up GitHub Copilot Agent Mode integration.\n\n**Alternative: manual install.** Copy the skills to your Copilot skills directory:\n\n```\n\u003cuser\u003e/.copilot/skills/\n```\n\nThis gives you the skills without the IDE features (scanning UI, vulnerability browser, Aviator inline fixes, MCP server).\n\n### OpenAI Codex\n\nThis repository includes a marketplace catalog at `.agents/plugins/marketplace.json`. When the repo is your current workspace, Codex discovers it automatically as a repo-scoped marketplace. Open the plugin directory, select **OpenText Fortify**, and install **fortify-skills**.\n\nTo make the plugin available across all workspaces, add an entry to your personal marketplace at `~/.agents/plugins/marketplace.json` (create the file if it doesn't exist), replacing `\u003cpath\u003e` with the absolute path to this directory:\n\n```json\n{\n  \"name\": \"fortify\",\n  \"interface\": { \"displayName\": \"OpenText Fortify\" },\n  \"plugins\": [\n    {\n      \"name\": \"fortify-skills\",\n      \"source\": { \"source\": \"local\", \"path\": \"\u003cpath\u003e\" },\n      \"policy\": { \"installation\": \"AVAILABLE\", \"authentication\": \"ON_INSTALL\" },\n      \"category\": \"Security\"\n    }\n  ]\n}\n```\n\nThen restart Codex. The plugin registers all nine skills automatically.\n\n### Gemini CLI\n\nInstall directly from the GitHub repository:\n\n```bash\ngemini extensions install https://github.com/fortify/skills\n```\n\nThe extension bundles all nine skills. Gemini CLI auto-discovers them and activates whichever skill is relevant to your task.\n\nTo test locally before publishing:\n\n```bash\ngemini extensions link /path/to/public\n```\n\n### Other AI assistants\n\nAny assistant that supports the [Agent Skills](https://agentskills.io) standard can load skills from this directory. Point your assistant's skill path to the `skills/` subdirectory.\n\n## Usage\n\nOnce installed, the skills activate automatically when relevant. Examples of prompts that trigger each skill:\n\n| Prompt | Skill / Agent activated |\n|--------|------------------------|\n| \"Onboard this repo to Fortify\" | fortify-onboarding (agent) |\n| \"Create a new application in FoD for our payments team\" | fortify-create-app |\n| \"Show me all critical issues in the payment-service release\" | fortify-fod |\n| \"Upload my FPR and check policy compliance\" | fortify-ssc |\n| \"Fix the SQL Injection findings in UserService.java\" | fortify-remediate |\n| \"Remediate the open source / SCA findings by upgrading the vulnerable dependencies\" | fortify-dependency-upgrade |\n| \"Add a new endpoint that returns account details\" | fortify-change-review |\n| \"Add Fortify scanning to my GitHub Actions workflows\" | fortify-cicd-integration |\n| \"Create a custom fcli action to export FoD critical issues as CSV\" | fortify-fod + fcli-common |\n\n\n## Resources\n\n- [Fortify CLI (fcli) — GitHub](https://github.com/fortify/fcli)\n- [Fortify on Demand documentation](https://www.microfocus.com/documentation/fortify-on-demand/)\n- [Software Security Center documentation](https://www.microfocus.com/documentation/fortify-software-security-center/)\n\n## License\n\nMIT\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffortify%2Fskills","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffortify%2Fskills","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffortify%2Fskills/lists"}