qa-security-scanning plugin
Security scanning across SAST, DAST, SCA, secrets and SBOM: Semgrep, CodeQL, SonarQube, ZAP, Nuclei, Snyk, OSV-Scanner, gitleaks, Syft and Trivy. Also covers language-native SAST linters, Dependabot and Renovate, package-manager audits, reachability and CVE exploitability triage, secret rotation, and VEX. A gate agent (security-finding-triager) normalizes, dedupes and waiver-checks multi-scanner output, including IaC findings from qa-iac, into one BLOCK / PASS verdict per domain. Every scanner skill includes a false-positive triage section.
How to install the qa-security-scanning plugin
Run both commands inside Claude Code. The first adds the marketplace once; the second installs the plugin.
/plugin marketplace add testland/qa
/plugin install qa-security-scanning@testland-qaWhat's inside qa-security-scanning
18 parts read from the plugin's own files.
Agents 1
Call as @agent-qa-security-scanning:name- @agent-qa-security-scanning:security-finding-triagersonnet
Use proactively whenever several security scanners (SAST, DAST, secrets, SCA, container or SBOM, IaC) ran on a PR and it needs one decision. Normalizes and dedupes findings, enforces waivers with expiry and approver, adds EPSS and CISA KEV, and posts one PR comment with a BLOCK or PASS per domain.
Skills 17
Claude loads it when the task matches- codeql-queries
No description in the file.
- cve-exploitability-triage
No description in the file.
- dependabot-config
No description in the file.
- dependency-vulnerability-scanning
No description in the file.
- gitleaks-scanning
No description in the file.
- language-native-sast
No description in the file.
- multi-tool-finding-triage
No description in the file.
- nuclei-dast
No description in the file.
- reachability-analyzer
No description in the file.
- renovate-config
No description in the file.
- secrets-rotation-runner
No description in the file.
- semgrep-rules
No description in the file.
- sonarqube-rules
No description in the file.
- syft-generation
No description in the file.
- trivy-image
No description in the file.
- vex-author
No description in the file.
- zap-baseline
No description in the file.
Using qa-security-scanning in Claude Code
Ask for an agent by name:
@agent-qa-security-scanning:security-finding-triagerSkills need no command. Claude reads them when your request matches what they describe.
Update, turn off or remove
- Update the plugin (shell)
- claude plugin update qa-security-scanning@testland-qa
- Refresh the marketplace
- /plugin marketplace update testland-qa
- Turn it off for now
- /plugin disable qa-security-scanning@testland-qa
- Remove it
- /plugin uninstall qa-security-scanning@testland-qa
qa-security-scanning plugin questions
How do I install the qa-security-scanning plugin?
In Claude Code run /plugin marketplace add testland/qa, then /plugin install qa-security-scanning@testland-qa.
What does the qa-security-scanning plugin include?
qa-security-scanning bundles 1 agent, 17 skills.
Which agents come with qa-security-scanning?
security-finding-triager. Call one with @agent-qa-security-scanning:security-finding-triager.
How do I update or remove the qa-security-scanning plugin?
Update it with claude plugin update qa-security-scanning@testland-qa in your shell, or from the Installed tab of /plugin. Remove it with /plugin uninstall qa-security-scanning@testland-qa.
What license is the qa-security-scanning plugin under?
MIT, as stated in the plugin's manifest.