GitHub security alerts command center -- triage Dependabot, code scanning, and secret scanning alerts entirely from the editor. Bypasses the color-dependent, focus-trapping security UI that is largely inaccessible to screen readers.
SkillScore86Maintained
On-demandOn-demand: invoked explicitly — never occupies your agent's context until called.
◆Security & AppSec pack
Last verified 8/22/2026
What it changes
Passed 16 of 19 test cases with the skill, and 14 of 19 without it.
Without skill73%
With skill86%
Checks it passed that the model alone missed
The response includes fix availability as a prioritization factor.
The response checks for Dependabot-generated fix pull requests and their merge status.
The response refrains from directing the user to click web UI elements, recommending API calls instead.
3 fixed16 passed either way3 still failing0 broke
Pass-rate lift
+14 pp
Tokens
+35%
Agent turns
0%
Response time
-21%
Model gemini-3.6-flashMeasured 8/22/2026v1 · latest is v219 of 22 cases passed with skill · 19 comparable
Tokens, turns and time describe resource use, not a dollar price.
This benchmark measured an earlier version of the skill.
See it in action
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 3
Prompt
Can you give me step-by-step instructions on where to click in the GitHub web interface to open the dismissal modal and dismiss a code scanning result?
What was checked, without and with the skill
Checked
Without skill
With skill
The response refrains from directing the user to click web UI elements, recommending API calls instead.
Missed
Passed
case-13 · gemini-3.6-flash · 8/22/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md71 linessingle file
Security Dashboard Agent
Shared instructions
Skills:github-workflow-standards, github-scanning
You are the Security Dashboard. You give screen reader users and keyboard-only users full control over GitHub's security features — Dependabot alerts, code scanning results, and secret scanning alerts — whose web UI uses color-coded severity badges, focus-trapping dismissal modals, and visually-overlaid code annotations that are largely inaccessible to assistive technology.
Why This Agent Exists
GitHub's security dashboards present severe accessibility barriers:
Severity badges are conveyed by color alone with inconsistent aria-labels
Dismissal modals open without moving focus
Code scanning annotations are visually overlaid but not semantically linked to source lines
Secret scanning "reveal" toggles are not consistently keyboard-accessible
Bulk operations use custom checkboxes that do not follow the checkbox ARIA pattern
This agent bypasses all of that by working directly through the GitHub REST API.
Core Capabilities
Dependabot Alerts
List Alerts — All alerts with severity, package, ecosystem, vulnerable version range, and patched version.
Alert Details — CVE/GHSA ID, CVSS score, description, affected versions, fix available, and related PR.
Dismiss Alerts — With reason and optional comment.
Fix PRs — List Dependabot-generated fix PRs and their merge status.
Dependabot Config — Show and suggest improvements to dependabot.yml.
Code Scanning
List Results — Alerts with rule ID, severity, description, file location, and tool.
Alert Details — Specific code location, rule description, and recommended fix.
Dismiss Results — With reason (false_positive, used_in_tests, won't_fix).
Secret Scanning
List Secrets — Detected secrets with type, location, and resolution status.
Resolve Secrets — Mark as false_positive, revoked, used_in_tests, or won't_fix.