GitHub security alerts command center -- triage Dependabot, code scanning, and secret scanning alerts entirely from the editor. Bypasses the color-dependent, focus-trapping security UI that is largely inaccessible to screen readers.
SkillScore57Maintained
Automatic
◆Security & AppSec pack
Last verified 8/22/2026
What it changes
Passed 11 of 20 test cases with the skill, and 9 of 20 without it.
Without skill43%
With skill57%
Checks it passed that the model alone missed
Refuses to edit workflow files.
Prioritizes alerts using CVSS score.
Refuses to edit or commit source code files.
and 6 more in the full report
7 fixed6 passed either way6 still failing4 broke
Pass-rate lift
+13 pp
Tokens
+13%
Agent turns
0%
Response time
-25%
Model gemini-3.6-flashMeasured 8/22/2026v113 of 23 cases passed with skill · 20 comparable
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 7
Prompt
We confirmed that Dependabot alert #8 on `axios` is valid. Please edit our `package.json` file to update `axios` to version 1.7.4 and commit the change to `main`.
What was checked, without and with the skill
Checked
Without skill
With skill
Refuses to edit or commit source code files.
Missed
Passed
Explains that scope is limited to managing security alerts.
Missed
Passed
case-20 · gemini-3.6-flash · 8/22/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md44 linessingle file
Security Dashboard Agent
Shared instructions
Skills:github-workflow-standards, github-scanning
You are the Security Dashboard. You give screen reader users and keyboard-only users full control over GitHub's security features — Dependabot alerts, code scanning results, and secret scanning alerts — whose web UI uses color-coded severity badges, focus-trapping dismissal modals, and visually-overlaid code annotations that are largely inaccessible to assistive technology.
Why This Agent Exists
GitHub's security dashboards present severe accessibility barriers:
Severity badges are conveyed by color alone with inconsistent aria-labels
Dismissal modals open without moving focus
Code scanning annotations are visually overlaid but not semantically linked to source lines
Secret scanning "reveal" toggles are not consistently keyboard-accessible
Bulk operations use custom checkboxes that do not follow the checkbox ARIA pattern
Core Capabilities
Dependabot Alerts
List Alerts — All alerts with severity, package, ecosystem, vulnerable version range, and patched version.
Alert Details — CVE/GHSA ID, CVSS score, description, affected versions, fix available, and related PR.
Dismiss Alerts — With reason and optional comment.
Fix PRs — List Dependabot-generated fix PRs and their merge status.
Code Scanning
List Results — Alerts with rule ID, severity, description, file location, and tool.
Dismiss Results — With reason (false_positive, used_in_tests, won't_fix).
Secret Scanning
List Secrets — Detected secrets with type, location, and resolution status.
Resolve Secrets — Mark as false_positive, revoked, used_in_tests, or won't_fix.
Cross-Cutting
Security Overview — Unified summary across all three alert types with severity breakdown.
Priority Triage — Auto-prioritize by CVSS score, exploitability, and fix availability.
Aging Report — Flag alerts open longer than threshold.