{
  "markdown": "# SurveyMonkey Skills\n\n[![gates](https://github.com/SurveyMonkey/skills/actions/workflows/gates.yml/badge.svg?branch=main)](https://github.com/SurveyMonkey/skills/actions/workflows/gates.yml)\n\n> A Claude Code plugin marketplace containing job-scoped plugins for SurveyMonkey engineering workflows. Each plugin groups related skills under a single namespace so they can be installed and invoked together.\n\n## Installation\n\nAdd the marketplace to your Claude Code settings:\n\n```bash\nclaude plugin install gh-security@SurveyMonkey/skills\n```\n\n## Available Plugins\n\n| Plugin | Namespace | Summary |\n|---|---|---|\n| [gh-security](#gh-security) | `/gh-security:*` | Orchestrated, multi-subagent resolution of Dependabot security alerts, plus an audit of the dependency pins earlier fixes leave behind that opens its own removal PR |\n\n### gh-security\n\nResolves Dependabot security alerts for one repository, an entire org, or all of your own repos.\nDiscovery ranks open alerts by severity and EPSS exploitability, you choose how much to fix (one\npackage, the highest severity tier, or everything), and the orchestrator dispatches one subagent\nper package major line per repo, each working in an isolated git worktree through to a pull\nrequest, open for review, that carries a computed merge-risk rating.\n\n| Entry point | Kind | What it does |\n|---|---|---|\n| `resolve-alerts` | Skill | Triggers from natural language (\"fix this repo's security alerts\", \"clean up npm audit findings\"). Discovers, ranks, and batches alerts, then dispatches one fix subagent per group through a capacity-bounded workflow and reports the pull requests they open. |\n| `/gh-security:resolve-alerts` | Command | Explicit entry point for the same skill. |\n| `/gh-security:audit-pins` | Command | Reports which of a repo's dependency pins (overrides and resolutions) are no longer needed, testing each removal in an isolated worktree against every published advisory for the package, then opens a PR removing the confirmed set. Report-only is offered as the alternative. Preflights for the repo's own open `security`-labeled PRs first, and stops if any exist: run it after those fix PRs have merged or been closed. |\n\nTwo subagents do the work, each dispatched by its own entry point: `fix-dependency` runs in\nparallel from a capacity-bounded workflow, and `audit-pins` is dispatched alone, one repository at\na time.\n\n| Agent | Role |\n|---|---|\n| `fix-dependency` | Fixes every alert for one package major line in one repo, in an isolated worktree, through to a pull request, open for review, with a computed merge-risk rating. Dispatched only by `resolve-alerts`. |\n| `audit-pins` | Audits one repository's pins and reports which are removable, including whether removing one shifts any other package's resolution, and in PR mode removes the confirmed set, tests it in one further install, and opens a PR. Dispatched only by `/gh-security:audit-pins`, never by `resolve-alerts`: the two flows edit the same overrides block from different directions, and running them together produces conflicting or invalidated PRs ([#108](https://github.com/SurveyMonkey/skills/issues/108)). |\n\n**Supported package managers, by advisory ecosystem:**\n\n- `npm`: pnpm, npm, and Yarn Berry (v2+). bun and Yarn Classic (v1) are rejected with a clear\n  message rather than guessed at.\n- Every other ecosystem (`pip`, `rubygems`, `maven`, `nuget`, `composer`, `go`, `rust`, and the\n  rest) is reported, not attempted. `pip` is planned as RFC 001 Phase 6\n  ([#9](https://github.com/SurveyMonkey/skills/issues/9)). See\n  [CONTRIBUTING.md](.github/CONTRIBUTING.md) to request one.\n\n**What the plugin does, at headline level:**\n\n- **A capacity-bounded pool of fix subagents.** One subagent per package major line per repo, each\n  in its own git worktree under the target repo, dispatched by a single workflow that keeps the\n  pool at the machine's capacity: every time one finishes, the next queued fix takes its slot.\n- **Repo, org, or user scope.** Point it at the current repo, a whole GitHub org, or everything\n  you own; org runs filter to repos you can actually push to.\n- **Risk-ranked discovery.** Alerts are grouped by package and major line, then ranked by\n  severity and EPSS exploitability so the worst goes first.\n- **A merge-risk rating on every PR.** Seven scored factors (version delta, runtime exposure,\n  usage surface, test coverage of the affected surface, CI presence, override blast radius, and\n  declared-range distance) band each fix Low, Medium, or High, and a major version delta or a\n  newly added global pin never rates Low. The score is static analysis of the repository, so no\n  agent runs your test suite; CI on the pull request is the verifier. Every PR that scored also\n  carries a `merge-risk:<band>` label matching its own PR body — `merge-risk:low` (green, `#2da44e`),\n  `merge-risk:medium` (yellow, `#d4a72c`), `merge-risk:high` (red, `#cf222e`) — so a repo's PR list\n  distinguishes low-risk fixes from ones that deserve a closer read without opening each one. It\n  names *merge* risk, not alert severity, which is why the prefix is `merge-risk:` and never a\n  bare `risk:`; the labels are created automatically the first time a repo needs one.\n- **Lockfile validation that refuses to bluff.** A fix claims completion only when the lockfile\n  proves the vulnerable ranges are gone, and a parser finding nothing is an error, never a pass.\n- **PRs open ready for review, and nothing touches them after that.** One approval, before\n  anything is dispatched, covers the whole batch; from there the PR is the artifact you review and\n  merge on GitHub, where reviewers and CODEOWNERS are notified. The plugin never merges a PR and\n  never arms auto-merge. The closing report states each PR's check state honestly rather than\n  gating on it.\n- **Pin audit, run separately, that opens its own removal PR.** `/gh-security:audit-pins` finds\n  overrides and resolutions that no longer protect anything, judged against the full advisory\n  database (which the pin itself blinds repo alert history to), including collateral effects of\n  removing each pin. Each pin is tested on its own, the removable set is then tested once more\n  together, and a PR removes it with that evidence in the body. Report-only stays available as the\n  alternative. It is its own flow, not part of a `resolve-alerts` run: the two edit the same\n  overrides block from opposite directions, so the audit preflights for the repo's own open\n  `security`-labeled PRs and stops if any exist, asking that they be merged or closed first\n  ([#108](https://github.com/SurveyMonkey/skills/issues/108)).\n- **Proactive nudge hook.** A PostToolUse hook watches Bash output for push-time vulnerability\n  notices, Dependabot alert URLs, and non-zero `npm`/`pnpm`/`yarn audit` output. A GitHub-sourced\n  match offers `resolve-alerts` directly; an audit-only match nudges toward checking GitHub\n  alerts first, since GitHub stays the sole source the fix pipeline acts on. It stays silent when\n  the push came from one of the plugin's own branches, so a dispatched fix or audit run is never\n  nudged to offer the flow it is already part of. Local grep/jq only; it never makes network calls.\n\n## Documentation\n\nHow the marketplace and its plugins are structured: [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md).\nDecision records live in [docs/adr/](docs/adr/index.md) and RFCs in\n[docs/rfc/](docs/rfc/index.md).\n\n## For SurveyMonkey Engineers\n\nThis repository is public so that any SurveyMonkey engineer can install these plugins without needing to be added to the GitHub org. See [CONTRIBUTING.md](.github/CONTRIBUTING.md) for how to propose new plugins or skills.\n\n## License\n\n[MIT](LICENSE)\n",
  "bytes": 7715,
  "sha": "afad8da3cff8a42ae70f3b5c91e2eded584907cef2ad02746ef4129ea31b4f74",
  "repo_slug": "surveymonkey/skills",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/okf_surveymonkey_skills_docs_index_md_20ed16fa/readme"
}