{
  "markdown": "# OpenText Fortify Skills\n\nAI agent skills that teach Claude, GitHub Copilot and other AI agents how to use [OpenText Fortify](https://www.opentext.com/products/application-security) effectively — covering SAST/DAST/SCA scanning, vulnerability triage, audit workflows, remediation, dependency upgrades, CI/CD integration, FCLI commands and more.\n\n## Skills\n\n| Skill | Description |\n|-------|-------------|\n| **fortify-fod** | Fortify on Demand (SaaS) — applications, releases, scans, issues, OSS analysis, portfolio reporting |\n| **fortify-ssc** | Software Security Center (on-premise) — manage application versions, artifacts, scan jobs, issue triage |\n| **fortify-remediate** | Fix SAST and DAST vulnerabilities detected by Fortify; Aviator AI remediation |\n| **fortify-dependency-upgrade** | Remediate SCA / open source findings (vulnerable dependencies, CVEs) by upgrading versions and fixing resulting breakage |\n| **fortify-exploitability-analysis** | Triage whether a known CVE/GHSA is actually exploitable (reachable) in this project, as opposed to just present |\n| **fortify-change-review** | Detect common, high impact security issues in code as it is being generated |\n| **fortify-create-app** | Create new Fortify applications in FoD or SSC — guided onboarding with validation and defaults |\n| **fortify-cicd-integration** | Add Fortify scanning to CI/CD pipelines — GitHub Actions, GitLab CI, Azure DevOps, Jenkins |\n| **fcli-common** | Fortify CLI (fcli) — installation, authentication, output formats, SpEL queries, custom actions |\n\n\n## Agents\n\nAgents are multi-skill orchestrators that handle end-to-end workflows.\n\n| Agent | Description |\n|-------|-------------|\n| **fortify-onboarding** | Onboard new applications into Fortify (FoD or SSC) — creates the app, configures settings, and optionally sets up CI/CD scanning pipelines. Handles single repos, bulk lists, or entire GitHub/GitLab/Azure DevOps organizations |\n| **fortify-exploitability-analysis** | Batch-triage a list of known CVEs/GHSAs for reachability across a codebase — sourced from an SBOM, a Fortify on Demand release, an SSC application version, or an explicit list. Produces per-CVE reports plus a combined CycloneDX VEX file |\n\n## Prerequisites\n\n- **fcli** installed and on your PATH — [install instructions](skills/fcli-common/references/fcli-install.md)\n- An active Fortify on Demand (FoD) or Software Security Center (SSC) account\n- An AI assistant that supports Agent Skills (Claude Code, GitHub Copilot, Cursor, Gemini CLI, etc.)\n\n## Installation\n\n### Claude Code\n\nAdd the marketplace from GitHub, then install the plugin:\n\n```bash\nclaude plugin marketplace add fortify/skills\nclaude plugin install fortify-skills@fortify\n```\n\nThe plugin registers all nine skills and both agents automatically.\n\n### GitHub Copilot\n\n**Recommended: install the [Fortify Code Security](https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-code-security) VS Code extension.** It bundles all Fortify skills, can automatically install fcli, and adds full IDE integration (scanning, vulnerability review, Aviator AI remediation, and an optional fcli MCP server):\n\n1. Open VS Code and search for **Fortify Code Security** in the Extensions panel, or install directly:\n   ```\n   ext install fortifyvsts.fortify-code-security\n   ```\n2. The extension registers all skills automatically and sets up GitHub Copilot Agent Mode integration.\n\n**Alternative: manual install.** Copy the skills to your Copilot skills directory:\n\n```\n<user>/.copilot/skills/\n```\n\nThis gives you the skills without the IDE features (scanning UI, vulnerability browser, Aviator inline fixes, MCP server).\n\n### OpenAI Codex\n\nThis repository includes a marketplace catalog at `.agents/plugins/marketplace.json`. When the repo is your current workspace, Codex discovers it automatically as a repo-scoped marketplace. Open the plugin directory, select **OpenText Fortify**, and install **fortify-skills**.\n\nTo make the plugin available across all workspaces, add an entry to your personal marketplace at `~/.agents/plugins/marketplace.json` (create the file if it doesn't exist), replacing `<path>` with the absolute path to this directory:\n\n```json\n{\n  \"name\": \"fortify\",\n  \"interface\": { \"displayName\": \"OpenText Fortify\" },\n  \"plugins\": [\n    {\n      \"name\": \"fortify-skills\",\n      \"source\": { \"source\": \"local\", \"path\": \"<path>\" },\n      \"policy\": { \"installation\": \"AVAILABLE\", \"authentication\": \"ON_INSTALL\" },\n      \"category\": \"Security\"\n    }\n  ]\n}\n```\n\nThen restart Codex. The plugin registers all nine skills automatically.\n\n### Gemini CLI\n\nInstall directly from the GitHub repository:\n\n```bash\ngemini extensions install https://github.com/fortify/skills\n```\n\nThe extension bundles all nine skills. Gemini CLI auto-discovers them and activates whichever skill is relevant to your task.\n\nTo test locally before publishing:\n\n```bash\ngemini extensions link /path/to/public\n```\n\n### Other AI assistants\n\nAny assistant that supports the [Agent Skills](https://agentskills.io) standard can load skills from this directory. Point your assistant's skill path to the `skills/` subdirectory.\n\n## Usage\n\nOnce installed, the skills activate automatically when relevant. Examples of prompts that trigger each skill:\n\n| Prompt | Skill / Agent activated |\n|--------|------------------------|\n| \"Onboard this repo to Fortify\" | fortify-onboarding (agent) |\n| \"Create a new application in FoD for our payments team\" | fortify-create-app |\n| \"Show me all critical issues in the payment-service release\" | fortify-fod |\n| \"Upload my FPR and check policy compliance\" | fortify-ssc |\n| \"Fix the SQL Injection findings in UserService.java\" | fortify-remediate |\n| \"Remediate the open source / SCA findings by upgrading the vulnerable dependencies\" | fortify-dependency-upgrade |\n| \"Is CVE-2021-44228 actually exploitable in this project?\" | fortify-exploitability-analysis |\n| \"Triage all the CVEs in this SBOM for reachability\" | fortify-exploitability-analysis (agent) |\n| \"Add a new endpoint that returns account details\" | fortify-change-review |\n| \"Add Fortify scanning to my GitHub Actions workflows\" | fortify-cicd-integration |\n| \"Create a custom fcli action to export FoD critical issues as CSV\" | fortify-fod + fcli-common |\n\n\n## Resources\n\n- [Fortify CLI (fcli) — GitHub](https://github.com/fortify/fcli)\n- [Fortify on Demand documentation](https://www.microfocus.com/documentation/fortify-on-demand/)\n- [Software Security Center documentation](https://www.microfocus.com/documentation/fortify-software-security-center/)\n\n## License\n\nMIT\n",
  "bytes": 6592,
  "sha": "63a03672e8f809d4f09fac1698bca27dd1a95d0bc9a43432824e1d81b392ea9a",
  "repo_slug": "fortify/skills",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_fortify_skills_e260eb90/readme"
}