Updated 1w ago
by fortify
skills
AI agent skills for OpenText Fortify — SAST/DAST/SCA scanning, vulnerability triage, remediation, dependency upgrades, CI/CD integration, and FCLI workflows. Works with Claude Code, Codex, Gemini CLI, GitHub Copilot, and more.
22 GitHub stars (22)
Steady at 22 stars — no new stars in the 16 days since Sep 30.
- 9 skills (9 skills found in its SKILL.md files)
- 2 forks (2 forks)
- 1w ago last update (Last updated 1w ago)
Install
Skills CLI
npx skills add fortify/skills
Asks which skills and agents to install. Just one: npx skills add fortify/skills --skill fcli-common — add -g for every project.
Claude Code
git clone https://github.com/fortify/skillscp -r "skills/skills/fcli-common" ~/.claude/skills/
Copies the fcli-common skill into ~/.claude/skills/ for every project (use .claude/skills/ for one project). Repeat for the other skills listed below.
Plugin
/plugin marketplace add fortify/skills
Run inside Claude Code if the repository ships a plugin marketplace, then pick plugins from /plugin.
Skills can run code on your machine — read the SKILL.md first.
What it does
In the author's own words, from each skill's SKILL.md.
-
fcli-common
Generic reference for the Fortify CLI (fcli). Install, upgrade, authenticate, fcli environment variables, output formats, SpEL query syntax, variable chaining and custom action framework.
skills/fcli-common/SKILL.md on GitHub (opens in a new tab) -
fortify-change-review
Lightweight, AI-powered security review of code CHANGES (a diff, PR, or in-session edits) using the agent's own analysis — no Fortify scan engine or platform needed. Use when the user asks to "run a Fortify security review" / "Fortify change review", or when adding/modifying code touching authentication, authorization, input handling, output encoding, data access, file operations, outbound HTTP,…
skills/fortify-change-review/SKILL.md on GitHub (opens in a new tab) -
fortify-cicd-integration
Integrate Fortify application security (SAST, SCA, DAST) with GitHub Actions, GitLab Pipelines, Azure DevOps, Jenkins & other CICD/DevSecOps pipelines.
skills/fortify-cicd-integration/SKILL.md on GitHub (opens in a new tab) -
fortify-create-app
Create new Fortify application(s) in Fortify on Demand (FoD) or Application Security Center (SSC).
skills/fortify-create-app/SKILL.md on GitHub (opens in a new tab) -
fortify-dependency-upgrade
Perform dependency upgrade impact assessment, code fixes, and migration work. Use to remediate Fortify SCA / open source / software composition analysis findings — vulnerable third-party dependencies, CVEs/GHSAs, components flagged by FoD or SSC — by upgrading to a safe version and fixing any resulting breakage. Also use when the user asks what will break after a version change, hits compile/test…
skills/fortify-dependency-upgrade/SKILL.md on GitHub (opens in a new tab) -
fortify-exploitability-analysis
Triage whether a known CVE/GHSA vulnerability is actually exploitable in this project. Use when the user wants a reachability verdict on a specific advisory — is the project really affected, or is the advisory noise? Analysis only; for fixes, hand off to fortify-dependency-upgrade.
skills/fortify-exploitability-analysis/SKILL.md on GitHub (opens in a new tab) -
fortify-fod
Perform tasks against Fortify on Demand (FoD): query applications/releases; query & triage existing security issues in FoD; start & monitor full SAST/DAST/SCA/open source scans of the codebase; create releases; import FPR/SARIF/CycloneDX artifacts; policy and portfolio analysis. NOT for lightweight AI review of local code changes/diffs (use fortify-change-review).
skills/fortify-fod/SKILL.md on GitHub (opens in a new tab) -
fortify-remediate
Remediate SAST (static) and DAST (dynamic) security vulnerabilities ALREADY detected by Fortify in FoD or SSC — fix specific issues, categories, or reduce issue counts, including applying SAST Aviator fixes. For SCA / open source dependency findings (vulnerable third-party components, CVEs), use fortify-dependency-upgrade instead. NOT for discovering or reviewing new issues (use fortify-change-re…
skills/fortify-remediate/SKILL.md on GitHub (opens in a new tab) -
fortify-ssc
Perform tasks against Fortify SSC (Software Security Center): query applications/application versions; query & triage existing security issues in SSC; start & monitor full ScanCentral SAST/DAST scans or upload FPR artifacts; create app versions; policy and portfolio analysis. NOT for lightweight AI review of local code changes/diffs (use fortify-change-review).
skills/fortify-ssc/SKILL.md on GitHub (opens in a new tab)
No skill matches that filter.
Review before you install
A skill is a set of instructions and scripts your agent will follow, and it can run code on your machine. Read the SKILL.md and any scripts first — this listing is not a security review.
Similar skills
-
cc-sddby gotalab Turn approved specs into long-running autonomous implementation. A minimal, adaptable SDD harness with Agent Skills for Claude Code, Codex,…
-
reaby morluto Reverse engineer anything with agents, from app behavior down to native binaries.
-
ponytailby DietrichGebert Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote.
-
agent-skillsby addyosmani Production-grade engineering skills for AI coding agents.
-
taste-skillby Leonxlnx Agent skills that give coding agents taste: art direction, reference images and a browser check instead of generic AI pages
-
archifyby tt-a1i Turn any idea, plan, or codebase into a beautiful interactive diagram. An agent skill for Claude Code, Codex, and more.