Evaluate security capabilities of Rosetta including use of security tools and harnesses like semgrep, VVAH

[ElizaVetaFomka]

[github-actions]

Rosetta Triage

Classification: enhancement
Priority assessment: This is a medium-priority enhancement request to evaluate and potentially integrate security tooling (e.g., semgrep, VVAH) into Rosetta's capabilities. Security tooling integration is a meaningful improvement but requires scoping before implementation.

The issue body is empty — more detail would help prioritize and scope the work. Specifically:

• What security capabilities should Rosetta gain (static analysis, vulnerability scanning, harness integration)?
• What is VVAH in this context?
• Is this a request to use these tools within Rosetta workflows, or to evaluate whether Rosetta should support them?
• What is the target environment or pipeline where this would run?

Automated triage by Rosetta agent

[isolomatov-gd]

Proposal: https://github.com/griddynamics/rosetta/blob/main/docs/stories/security-proposal.md

[github-actions]

Rosetta Triage — Proposal Review

Proposal read: docs/stories/security-proposal.md

---

Summary

This proposes a Rosetta Security Skill that unifies output from existing scanners (Semgrep, Trivy, CodeQL, gitleaks, Checkov, OWASP ZAP, and many more) into a single normalized finding schema, then drives grouped, systemic remediation through Rosetta's coding-flow — rather than patching location by location. The operating model runs entirely inside the client's own infrastructure under the client's own authorization.

---

Strengths

• Complete tool taxonomy. Every major security domain is covered with a clear asset-file mapping (security-code.md, security-packages.md, security-iac.md, security-containers.md, security-kubernetes.md, security-cloud.md, security-secrets.md, security-api.md, security-web-dast.md, security-gateways.md, security-dns-recon.md, security-network-pentest.md, security-llm-ai.md). Offensive/active areas are correctly HARD-GATED behind explicit scope + ownership confirmation.

• Subagent orchestration fits Rosetta patterns. The orchestrator → area-runner → normalizer → triager → (remediator / pentester) chain is idiomatic and deduplication/FP-reduction is owned by a dedicated triager.

• Authorization-first protocol. Step 1 is AUTHORIZE; offensive areas require typed confirmation. Blast-radius gating (static/local = auto; network/active/offensive = require typed confirmation) is explicit.

• Grouped remediation. Fixing root causes once across many sites via coding-flow addresses the actual bottleneck (remediation, not detection), which is the correct framing.

• Evidence-backed problem statement. References to Mythos Preview, the autonomous AI hack incident, and VVAH ground the proposal in current events.

---

Gaps / open questions

1. Asset files not yet created. The proposal references assets/security-*.md files extensively, but none appear to exist yet. These will need to be authored before the skill is implementable.

2. Skill artifact not drafted. The proposal describes what the skill does but does not include the actual Rosetta skill file (skills/security/SKILL.md) or its schema. A next step would be a draft skill file.

3. Finding schema not defined. "Normalized into a single finding schema" is stated but the schema itself (fields, severity levels, dedup key) is not specified. This is a prerequisite for the normalizer subagent.

4. Sensitive-value masking protocol. The proposal mentions masking sensitive values before passing code to subagents but doesn't define how this interacts with the sensitive-data skill or what the masking mechanism is.

5. Baseline / diff reporting. "Reports and run statistics are both retained in the repository" is stated but the storage location, format, and lifecycle are not defined.

6. VVAH integration depth. VVAH appears in multiple asset files. It would help to clarify whether VVAH is a runtime dependency the skill spawns, a reference implementation to draw patterns from, or both.

---

Suggested next steps

• Draft skills/security/SKILL.md with the core protocol and subagent roster
• Define the common finding schema (JSON/YAML struct)
• Author assets/security-code.md as the first concrete asset file to validate the pattern
• Clarify VVAH's role (dependency vs. reference)

---

Automated triage by Rosetta agent