What's Changed
Added
- AGENTS.md — Agentic discovery metadata, invocation contracts, and GitHub MCP workflow for autonomous triage across full repositories
- Multi-agent compatibility — Explicit installation and invocation guidance for OpenAI Codex, Cursor, Windsurf, Gemini CLI, and GitHub Copilot
- COMPATIBILITY.md — Runtime-specific configuration details
**.claude/skills/structure** — Native Claude Code agentic skill path- Agentic Mode section in skill file — GitHub MCP proactive fetch logic, SHA-pin auditing grep pattern, graceful degradation when MCP unavailable
- CVSS agent guidance — Common agent CVSS errors documented (XSS S:C, CI/CD UI:R, transitive dep downgrade, AV:N context adjustment)
Changed
- Track D (CI/CD) — Expanded
pull_request_targetdetection heuristics with real-world PoC reference (CVE-2026-40316, GHSA-wxm3-64fx-cmx9) - Track C (LLM) — LLM01–LLM10 detection heuristics updated to OWASP LLM Top 10 2025
- Confidence gate — False-positive checklist expanded with LLM model-level vs application-level distinction as mandatory pre-classification step
- CVSS construction — Component-by-component reasoning now required in all reports; base score context adjustment added as mandatory field in AM I AFFECTED section
Fixed
- LOW confidence issues were appearing in findings summaries in edge cases — gate logic now explicitly suppresses them to Notes section only
Full changelog: https://github.com/S3DFX-CYBER/Claude-Skills-Security/blob/main/CHANGELOG.md