invoke-security

Agent Skills › AjayIrkal23/agentic-mercy-10x › invoke-security

invoke-security

GitHub

执行安全审查任务，调度 security-sentinel 代理生成 SECURITY-REPORT.md。支持复用运行文件夹、自动处理失败重试及结果报告，用于自动化安全评估流程。

skills/invoke-security/SKILL.md AjayIrkal23/agentic-mercy-10x

Trigger Scenarios

需要执行代码或配置的安全审查调用 /invoke security 命令生成安全审计报告

Install

npx skills add AjayIrkal23/agentic-mercy-10x --skill invoke-security -g -y

More Options

Use without installing

npx skills use AjayIrkal23/agentic-mercy-10x@invoke-security

指定 Agent (Claude Code)

npx skills add AjayIrkal23/agentic-mercy-10x --skill invoke-security -a claude-code -g -y

安装 repo 全部 skill

npx skills add AjayIrkal23/agentic-mercy-10x --all -g -y

预览 repo 内 skill

npx skills add AjayIrkal23/agentic-mercy-10x --list

SKILL.md

Frontmatter

{
    "name": "invoke-security",
    "description": "Run the SECURITY act — dispatches security-sentinel (default sonnet; opus-guard routes) and writes `SECURITY-REPORT.md` into a run folder. Single-act form of `\/invoke security -- <task>`.",
    "argument-hint": "[--run <dir>] [task]"
}

Run the security act for: $ARGUMENTS

This is /invoke security without the closers; ~/.claude/skills/invoke/SKILL.md governs anything not said here.

Run folder: --run <dir> in the arguments → reuse that folder (absolute path) and update its run.json with Edit; otherwise create a new one exactly as /invoke §2 (RUN="$(git rev-parse --show-toplevel)/.claude/runs/$(date -u +%Y%m%dT%H%M)-$SLUG", BRIEF.md, run.json with "acts": ["security"]). Never write into any other existing run folder.
Set run.json.expected_artifacts["security-sentinel"] = "SECURITY-REPORT.md".
Agent(subagent_type="security-sentinel", description="security: <task>", prompt=...). The prompt names $RUN/BRIEF.md, every artifact already in $RUN/, and the exact output path $RUN/SECURITY-REPORT.md. No model=: opus-guard routes it (pins, escalation, per-project mode). Artifact missing or the act failed → re-dispatch once with the prompt prefixed Previous attempt failed: <one-line reason>.
Append security to run.json.done, then report the artifact path and a one-paragraph verdict.