security-alert-review

Name: security-alert-review
Author: microsoft

31stars9forks

How to install security-alert-review?

microsoft/azure-devops-skills/security-alert-review

$npx -y skills add microsoft/azure-devops-skills --skill security-alert-review

Installs into the current project.

Summary

List and review Advanced Security alerts for an Azure DevOps repository. Shows dependency vulnerabilities, secret exposure, and code scanning findings with filtering by severity, state, and alert type.

Files · 1

View on GitHub

SKILL.md

1	# Security alert review
2
3	This skill works in the context of a project and a repository. Both are required to retrieve alerts.
4
5	## Project selection
6
7	- If the user provides a project name in their request (for example, "for Contoso"), use that project directly and do not call `core_list_projects`.
8	- If the user does not provide a project name, first ask the user once to provide the project name.
9	- If the project name is still not provided after asking once, call `core_list_projects` to return a list of projects the user can choose from.
10
11	## Repository selection
12
13	- If the user provides a repository name, use that repository directly.
14	- If the user does not specify a repository, ask the user once for the repository name.
15	- If the repository name is still not provided after asking once, call `repo_list_repos_by_project` to list available repositories for the user to choose from.
16
17	# Tools
18
19	Use Azure DevOps MCP Server tools for all interactions with Azure DevOps.
20
21	- `core_list_projects`: Get a list of projects in the organization.
22	- `repo_list_repos_by_project`: Get a list of repositories for a project.
23	- `advsec_get_alerts`: Get Advanced Security alerts for a repository, with optional filters for severity, state, alert type, and confidence level.
24	- `advsec_get_alert_details`: Get detailed information about a specific alert by ID.
25
26	# Rules
27
28	## 1. List alerts for a repository
29
30	- When the user asks to list alerts, show security alerts, or review alerts, call `advsec_get_alerts` for the specified project and repository.
31	- Apply filters based on the user's request:
32	- Severity: filter by `severities` (for example, "show critical alerts" → `["Critical"]`).
33	- State: filter by `states` (for example, "show active alerts" → `["Active"]`).
34	- Alert type: filter by `alertType` (for example, "show dependency alerts" → `"Dependency"`). Valid types are: `Dependency`, `Secret`, `Code`.
35	- Always include `confidenceLevels: ["High", "Other"]` on every call to `advsec_get_alerts` unless the user explicitly requests a specific confidence filter.
36	- If the user does not specify filters, show all active alerts on the default branch by default (use `onlyDefaultBranch: true`, `states: ["Active"]`, and `confidenceLevels: ["High", "Other"]`).
37	- Show the results in a table.
38	- If there are no alerts, explicitly state that there are no alerts matching the criteria for this repository.
39
40	### Example
41
42	- "show security alerts for repo MyApp in project Contoso"
43	- "list critical dependency alerts for repo MyApp"
44	- "show all active secret alerts in repo MyApp"
45
46	## 2. Get details for a specific alert
47
48	- When the user asks about a specific alert (for example, "alert 42" or "tell me about alert 42"), call `advsec_get_alert_details` with the alert ID, project, and repository.
49	- Show all available detail fields including the affected file, line number, description, remediation guidance, and rule information.
50
51	### Example
52
53	- "show details for alert 42 in repo MyApp, project Contoso"
54	- "what is alert 42 about?"
55
56	## 3. Summary view
57
58	- When the user asks for a summary or overview of alerts, call `advsec_get_alerts` (with no severity or type filter, `states: ["Active"]`, and `confidenceLevels: ["High", "Other"]`) and present a summary grouped by:
59	1. Alert type (Dependency, Secret, Code) with count.
60	2. Severity (Critical, High, Medium, Low, Other) with count per type.
61	- Show the summary as a compact table followed by the total count.
62	- Note: `advsec_get_alerts` returns up to 100 alerts by default. If the results include a continuation token, let the user know the summary is based on the first batch of alerts and that additional alerts exist.
63
64	### Example
65
66	- "give me a security overview for repo MyApp"
67	- "summarize the alerts in repo MyApp for project Contoso"
68
69	# Display results
70
71	When displaying alert lists, show in a table:
72
73	- Alert ID
74	- Title (the alert title or rule name)
75	- Severity with emoji: 🔴 Critical, 🟠 High, 🟡 Medium, 🟢 Low
76	- State (Active, Dismissed, Fixed, AutoDismissed)
77	- Alert type (Dependency, Secret, Code)
78	- Rule (the rule ID or name)
79	- First seen formatted as `MM/DD/YYYY`
80
81	When displaying alert details, show:
82
83	- All fields from the list view, plus:
84	- Description — full text of what the alert means.
85	- File path and line number (if applicable) — where the issue was found.
86	- Remediation — guidance on how to fix the issue (if available from the alert details).
87	- Confidence — High or Other (for secret alerts).
88	- Validity — Active, Inactive, or Unknown (for secret alerts).
89	- Tool name — the scanning tool that found the alert.
90
91	When displaying the summary view

People who liked this also viewed

6 picks

Type

security-alert-review

31stars9forks

View on GitHub

How to install security-alert-review?

microsoft/azure-devops-skills/security-alert-review

$npx -y skills add microsoft/azure-devops-skills --skill security-alert-review

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Security alert review
2
3	This skill works in the context of a project and a repository. Both are required to retrieve alerts.
4
5	## Project selection
6
7	- If the user provides a project name in their request (for example, "for Contoso"), use that project directly and do not call `core_list_projects`.
8	- If the user does not provide a project name, first ask the user once to provide the project name.
9	- If the project name is still not provided after asking once, call `core_list_projects` to return a list of projects the user can choose from.
10
11	## Repository selection
12
13	- If the user provides a repository name, use that repository directly.
14	- If the user does not specify a repository, ask the user once for the repository name.
15	- If the repository name is still not provided after asking once, call `repo_list_repos_by_project` to list available repositories for the user to choose from.
16
17	# Tools
18
19	Use Azure DevOps MCP Server tools for all interactions with Azure DevOps.
20
21	- `core_list_projects`: Get a list of projects in the organization.
22	- `repo_list_repos_by_project`: Get a list of repositories for a project.
23	- `advsec_get_alerts`: Get Advanced Security alerts for a repository, with optional filters for severity, state, alert type, and confidence level.
24	- `advsec_get_alert_details`: Get detailed information about a specific alert by ID.
25
26	# Rules
27
28	## 1. List alerts for a repository
29
30	- When the user asks to list alerts, show security alerts, or review alerts, call `advsec_get_alerts` for the specified project and repository.
31	- Apply filters based on the user's request:
32	- Severity: filter by `severities` (for example, "show critical alerts" → `["Critical"]`).
33	- State: filter by `states` (for example, "show active alerts" → `["Active"]`).
34	- Alert type: filter by `alertType` (for example, "show dependency alerts" → `"Dependency"`). Valid types are: `Dependency`, `Secret`, `Code`.
35	- Always include `confidenceLevels: ["High", "Other"]` on every call to `advsec_get_alerts` unless the user explicitly requests a specific confidence filter.
36	- If the user does not specify filters, show all active alerts on the default branch by default (use `onlyDefaultBranch: true`, `states: ["Active"]`, and `confidenceLevels: ["High", "Other"]`).
37	- Show the results in a table.
38	- If there are no alerts, explicitly state that there are no alerts matching the criteria for this repository.
39
40	### Example
41
42	- "show security alerts for repo MyApp in project Contoso"
43	- "list critical dependency alerts for repo MyApp"
44	- "show all active secret alerts in repo MyApp"
45
46	## 2. Get details for a specific alert
47
48	- When the user asks about a specific alert (for example, "alert 42" or "tell me about alert 42"), call `advsec_get_alert_details` with the alert ID, project, and repository.
49	- Show all available detail fields including the affected file, line number, description, remediation guidance, and rule information.
50
51	### Example
52
53	- "show details for alert 42 in repo MyApp, project Contoso"
54	- "what is alert 42 about?"
55
56	## 3. Summary view
57
58	- When the user asks for a summary or overview of alerts, call `advsec_get_alerts` (with no severity or type filter, `states: ["Active"]`, and `confidenceLevels: ["High", "Other"]`) and present a summary grouped by:
59	1. Alert type (Dependency, Secret, Code) with count.
60	2. Severity (Critical, High, Medium, Low, Other) with count per type.
61	- Show the summary as a compact table followed by the total count.
62	- Note: `advsec_get_alerts` returns up to 100 alerts by default. If the results include a continuation token, let the user know the summary is based on the first batch of alerts and that additional alerts exist.
63
64	### Example
65
66	- "give me a security overview for repo MyApp"
67	- "summarize the alerts in repo MyApp for project Contoso"
68
69	# Display results
70
71	When displaying alert lists, show in a table:
72
73	- Alert ID
74	- Title (the alert title or rule name)
75	- Severity with emoji: 🔴 Critical, 🟠 High, 🟡 Medium, 🟢 Low
76	- State (Active, Dismissed, Fixed, AutoDismissed)
77	- Alert type (Dependency, Secret, Code)
78	- Rule (the rule ID or name)
79	- First seen formatted as `MM/DD/YYYY`
80
81	When displaying alert details, show:
82
83	- All fields from the list view, plus:
84	- Description — full text of what the alert means.
85	- File path and line number (if applicable) — where the issue was found.
86	- Remediation — guidance on how to fix the issue (if available from the alert details).
87	- Confidence — High or Other (for secret alerts).
88	- Validity — Active, Inactive, or Unknown (for secret alerts).
89	- Tool name — the scanning tool that found the alert.
90
91	When displaying the summary view

People who liked this also viewed

6 picks

Type