Security Agent Discovery

Use this skill for read-only vulnerability discovery and data ingestion from a pip-installed Security Agent setup. Do not start fixes, clone repos, push branches, or create PRs from this workflow.

Preflight

Run from the central workspace. If any command fails, use $security-agent-setup.

cd ~/security-agent
test -f .env
.venv/bin/edi-security-agent --version

Use only the pip-installed CLI/UI from ~/security-agent. Do not call repo-local Python modules, Azure fetcher scripts, or files from edi-security-agent-controller. If setup needs Artifactory credentials, route to $security-agent-setup for the opt-in chat credential forwarding flow or own-Terminal fallback. If plain pip3 or a global edi-security-agent works but .venv/bin/edi-security-agent is missing, do not use the global install. Explain the pip-scope mismatch and route to $security-agent-setup so the package is installed into ~/security-agent/.venv.

Workflow

1. Prefer Azure Defender as the primary source. Required live Defender config is AZURE_REGISTRY_NAME and AZURE_ASSESSMENT_KEY; AZURE_SUBSCRIPTION_ID is strongly recommended.
2. Use explicit CLI listing for terminal workflows:

.venv/bin/edi-security-agent defender list --severity high
.venv/bin/edi-security-agent defender list --repo edi-claim-pacdr-batch-intake --severity high
.venv/bin/edi-security-agent defender list --repo edi-claim-pacdr-batch-intake --fixable-only
.venv/bin/edi-security-agent defender list --severity high --format json

3. Treat --severity high as a minimum threshold for CLI Defender listing. It includes critical and high.
4. For UI cache refresh, use the API only when the local UI/server is running:

curl -X POST "http://127.0.0.1:8000/api/vulns/refresh?source=azure-defender"

5. For Security Platform import, use only explicit user-provided ASK ID, session cookie, and DPoP through the UI/API. Never invent, persist, or log credential values.
6. Use exports only for reporting and analysis. Export mode is handled by /api/vulns/export.

Repo Names

Normalize Azure image repositories from iedi-* to GitHub-style edi-* when comparing with repo names. If the requested repo is ambiguous, list candidate repos and ask for the exact one before any fix workflow.

Safety

• Discovery is deterministic and does not use AI for remediation.
• Do not run defender fix from this skill.
• Do not bypass the installed CLI by running repo-local scripts or Python modules.
• Do not store cookies, DPoP values, GitHub tokens, OAuth secrets, or Azure credentials in files.
• If the user asks to fix or remediate findings, switch to the local-fix or CCA-fix skill.