Skip to content
sentrasec

Scan, find, fix skill

One skill that closes the loop: scan, read the findings, fix them, and re-scan to prove it.

The MCP tools give an agent the ability to scan and to read findings. A skill gives it the judgement to use them well — which order to work in, when a fix counts as proven, and which shortcuts are never acceptable.

This skill runs the full loop for each scanner: scan, read, fix, verify, report.

Install it

Save the skill below as ~/.claude/skills/sentrasec-scan-fix/SKILL.md, or drop it in .claude/skills/ inside a project to scope it there. Your agent picks it up automatically when a request matches its description.

Use it

Ask in plain language. There is no command to remember.

Scan this repo for security issues and fix what you find.

The agent runs each scanner in turn and, for every finding, will:

  • read the code at the reported line and confirm the finding is real;
  • apply the fix from that finding's fix_prompt, which carries its own acceptance criteria;
  • re-scan and compare, so “fixed” means observed, not assumed.

What it will not do

The rules below matter more than the happy path. An agent with edit access and a list of security findings has an obvious shortcut available — make the finding go away rather than make the problem go away — so the skill closes it explicitly:

  • never suppress a finding, loosen a rule, or move vulnerable code out of the scanner's reach instead of fixing it;
  • never report a secret as resolved by an edit — the credential must be rotated, because it is compromised the moment it reaches history;
  • never claim success against a re-scan that still shows the finding;
  • never run DAST against a system the user did not name.

The skill

SKILL.md
---name: sentrasec-scan-fixdescription: Scan a codebase or running app with Sentrasec, then fix what it finds. Use when asked to run a security scan, check for vulnerabilities, find secrets or injection flaws, audit dependencies, fix security findings, or prepare code for a security review. Covers SAST, SCA, secrets and DAST.---# Scan, find, fixRun Sentrasec against an app, read the findings, fix them, and prove the fix byre-scanning. One loop per scanner.## Before anything: credentialsEvery scan runs against a registered app under an app key, and the serverrecords the key's label against the scan. Check SENTRASEC_APP_ID andSENTRASEC_APP_KEY are set. If a tool returns a credentials error, tell the userto create a key under Developer Settings, and say plainly that the label theychoose will appear against every scan it runs. Do not work around a missing keyby scanning locally — a scan that never reaches the workspace is invisible toeveryone but you.## The loopRun this once per scanner. Do not batch scanners and fix at the end: fixes forone class of problem routinely change what another scanner sees.### 1. Scan    security.scan { kind: "sast" | "sca" | "secrets" | "dast" | "all" }`all` runs SAST + SCA + secrets. It excludes DAST, which sends live traffic ata running system — only run DAST when asked, against a target the user named.If a scanner fails, the others still run and the failure is reported in`failures`. Say which scanner failed rather than reporting a clean result.### 2. Read the findings    security.list_findings { scan_id, min_severity: "high" }    security.get_finding   { scan_id, finding_id }`security.get_finding` returns `agent_fix_prompt` — a specific instructionwith acceptance criteria, composed for that finding. Use it. It names the file,the line, the mechanism and what "fixed" means.Work in severity order: critical, then high, then the rest.### 3. Fix1. Read the file at the reported line. Confirm the finding is real before   changing anything — a scanner reports a pattern; you can see context it   cannot.2. Apply the fix from `agent_fix_prompt`, meeting every acceptance criterion.3. Keep the change minimal and local. Do not refactor around a security fix.If a finding is a false positive, say so and explain why, with evidence from thecode. Do not silently skip it.Never fix a finding by deleting the detection, loosening a rule, adding asuppression comment, or moving the vulnerable code somewhere the scanner doesnot look.### 4. Prove itRe-run the same scanner and compare. Findings that disappear are fixed. Afinding still present means the fix did not work — say so rather than reportingsuccess against a scan that still shows the issue.### 5. ReportState per scanner: what ran, what was found by severity, what you fixed, whatremains and why. Include the scan id.## Secrets need more than a code fixA committed credential is compromised the moment it lands in history. Alwaystell the user to rotate it at its source, move it to a secrets manager, and notethat it remains in git history. Never present a secrets finding as resolved byan edit alone.## DAST needs consentDAST sends real attack payloads at a running system. Only scan a URL the userexplicitly named, and never production without them saying so.

See Tools for the full tool reference, and Authentication for setting SENTRASEC_APP_ID and SENTRASEC_APP_KEY.