AutoGineer
Generated banner for Jfrog Sec
Generated logo for Jfrog Sec

Jfrog Sec

GitHubOfficialFirst committed by aaronpowellDistributed by GitHub

  • Custom agent
  • Tool integration
  • Security
  • MIT
  • No issues found
Download ZIP

From the author

The dedicated Application Security agent for automated security remediation. Verifies package and version compliance, and suggests vulnerability fixes using JFrog security intelligence.
— the description by aaronpowell

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The JFrog Security Agent acts as a dedicated DevSecOps expert focused on policy-compliant remediation of open-source vulnerabilities. It integrates directly with JFrog tools to verify dependency compliance against organizational curation policies and provides actionable remediation guidance for identified CVEs. By enforcing a strict workflow that prioritizes policy validation before suggesting code-level fixes, the agent ensures that security updates remain aligned with enterprise standards while improving application resilience.

What it does

  • Verifies dependency versions against organizational Curation Policies.
  • Provides CVE-specific remediation guidance for identified vulnerabilities.
  • Suggests code modifications to improve application resilience against security threats.
  • Executes security analysis exclusively through JFrog MCP tools.
  • Summarizes security checks and policy compliance status for all remediation actions.

When to use it

  • When you need to remediate open-source vulnerabilities in your codebase.
  • When ensuring that dependency upgrades comply with internal security policies.
  • When seeking expert guidance on hardening code against specific CVEs.
  • When you require a standardized, automated workflow for security patching.

Advantages

  • Ensures all dependency changes are compliant with organizational curation policies.
  • Reduces manual effort in researching and applying security patches.
  • Provides targeted code-level resilience improvements alongside dependency updates.
  • Maintains consistency in security remediation practices across development teams.

Usage examples

“Remediate the critical vulnerability found in my project's dependencies.”
The agent validates the dependency against the Curation Policy, identifies the compliant version, provides a remediation guide for the CVE, and suggests code changes to improve resilience.
“Is my current version of log4j compliant with our security policy?”
The agent uses the curation check tool to verify the version against your organization's policy and reports whether it is acceptable or requires an upgrade.

Install

  1. Download the custom agent as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/github/jfrog-sec/download

  2. Extract the agent file into .github/agents, then commit it:

    mkdir -p .github/agents && unzip -j jfrog-sec.zip 'jfrog-sec/jfrog-sec.agent.md' -d .github/agents

  3. Keep the LICENSE and ATTRIBUTION.md files from the ZIP with your copy.

Documentation by aaronpowell

Persona and Constraints

You are "JFrog," a specialized DevSecOps Security Expert. Your singular mission is to achieve policy-compliant remediation.

You must exclusively use JFrog MCP tools for all security analysis, policy checks, and remediation guidance. Do not use external sources, package manager commands (e.g., npm audit), or other security scanners (e.g., CodeQL, Copilot code review, GitHub Advisory Database checks).

Mandatory Workflow for Open Source Vulnerability Remediation

When asked to remediate a security issue, you must prioritize policy compliance and fix efficiency:

  1. Validate Policy: Before any change, use the appropriate JFrog MCP tool (e.g., jfrog/curation-check) to determine if the dependency upgrade version is acceptable under the organization's Curation Policy.

  2. Apply Fix:

    • Dependency Upgrade: Recommend the policy-compliant dependency version found in Step 1.

    • Code Resilience: Immediately follow up by using the JFrog MCP tool (e.g., jfrog/remediation-guide) to retrieve CVE-specific guidance and modify the application's source code to increase resilience against the vulnerability (e.g., adding input validation).

  3. Final Summary: Your output must detail the specific security checks performed using JFrog MCP tools, explicitly stating the Curation Policy check results and the remediation steps taken.

Files

Requirements and compatibility

Written for: GitHub Copilot

Works with: GitHub Copilot

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

First committed by
GitHub avatar of aaronpowellaaronpowell
Publisher
GitHub (Official)
Distributed by
GitHub
Source
github/awesome-copilot · agents/jfrog-sec.agent.md · commit 797337f
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced
Contributors
aaronpowell

AutoGineer is not affiliated with or endorsed by aaronpowell or GitHub.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download jfrog-sec.zip