fortify

fortify/skills

Plugin Claude Code

Plugin marketplace listing 1 plugin: fortify-skills.

fortify/skills

Plugin Claude Code

OpenText Fortify AppSec skills. Use for SAST/DAST/SCA scanning, vulnerability triage, audit workflows, CI/CD pipeline integration, and FCLI commands. Supports Fortify on Demand (FoD) and Software Security Center (SSC).

fortify/skills

Instructions file GitHub Copilot

Instructions for fortify/skills, covering fortify skills repository, structure, conventions, workflow terminology and reference path rules (per agent skills spec).

fortify/skills

Agent

Orchestrate batch CVE exploitability analysis across many known advisories. Activate to triage a list of CVEs/GHSAs for reachability in a codebase — sourced from an SBOM, a Fortify on Demand release, a Fortify SSC application version, a local file (CSV/JSON/text), or an explicitly provided list. Never discovers CVEs…

fortify/skills

Agent

Orchestrate end-to-end onboarding of new applications into Fortify (FoD or SSC). Activate to create one or more new Fortify applications, set up a project or repo for Fortify scanning, or onboard an entire GitHub/GitLab/Azure DevOps organization. Handles app creation and optional CI/CD pipeline setup (PR included).

fortify/skills

Skill Claude CodeCodex

Generic reference for the Fortify CLI (fcli). Install, upgrade, authenticate, fcli environment variables, output formats, SpEL query syntax, variable chaining and custom action framework.

fortify/skills

Skill Claude CodeCodex

Lightweight, AI-powered security review of code CHANGES (a diff, PR, or in-session edits) using the agent's own analysis — no Fortify scan engine or platform needed. Use when the user asks to "run a Fortify security review" / "Fortify change review", or when adding/modifying code touching authentication…

fortify/skills

Skill Claude CodeCodex

Integrate Fortify application security (SAST, SCA, DAST) with GitHub Actions, GitLab Pipelines, Azure DevOps, Jenkins & other CICD/DevSecOps pipelines.

fortify/skills

Skill Claude CodeCodex

Create new Fortify application(s) in Fortify on Demand (FoD) or Application Security Center (SSC).

fortify/skills

Skill Claude CodeCodex

Perform dependency upgrade impact assessment, code fixes, and migration work. Use to remediate Fortify SCA / open source / software composition analysis findings — vulnerable third-party dependencies, CVEs/GHSAs, components flagged by FoD or SSC — by upgrading to a safe version and fixing any resulting breakage. Also…

fortify/skills

Skill Claude CodeCodex

Triage whether a known CVE/GHSA vulnerability is actually exploitable in this project. Use when the user wants a reachability verdict on a specific advisory — is the project really affected, or is the advisory noise? Analysis only; for fixes, hand off to fortify-dependency-upgrade.

fortify/skills

Skill Claude CodeCodex

Perform tasks against Fortify on Demand (FoD): query applications/releases; query & triage existing security issues in FoD; start & monitor full SAST/DAST/SCA/open source scans of the codebase; create releases; import FPR/SARIF/CycloneDX artifacts; policy and portfolio analysis. NOT for lightweight AI review of local…

fortify/skills

Skill Claude CodeCodex

Remediate SAST (static) and DAST (dynamic) security vulnerabilities ALREADY detected by Fortify in FoD or SSC — fix specific issues, categories, or reduce issue counts, including applying SAST Aviator fixes. For SCA / open source dependency findings (vulnerable third-party components, CVEs), use…

fortify/skills

Skill Claude CodeCodex

Perform tasks against Fortify SSC (Software Security Center): query applications/application versions; query & triage existing security issues in SSC; start & monitor full ScanCentral SAST/DAST scans or upload FPR artifacts; create app versions; policy and portfolio analysis. NOT for lightweight AI review of local…