DryRun Skill

The DryRun Security skill gives your AI coding tool the context it needs to author, review, and remediate code securely.

AI coding tools are fast, but they operate in a silo. Left to their defaults, they may skip pull requests, ignore organizational best practices, and even when a PR is opened, they will not check for security findings unless explicitly told to. The DryRun Security skill closes that gap, giving the AI the context it needs to follow proper PR workflow and treat security findings as a required step in the process.

Three skills are available. The PR workflow skills cover the full pull request lifecycle: authoring, reviewing, and remediating findings on active PRs. The Finding Remediation skill extends that to DeepScan and SCA findings outside of open pull requests, with direct access to the DryRun Security knowledge graph for deeper remediation guidance.

Works with Claude Code, Codex, Cursor, Windsurf, and VS Code.

The PR Workflow #

The DryRun Security skill equips your AI coding tool with the context it needs to author, review, and remediate code securely across the lifecycle of a pull request.

Author #

The skill instructs the AI coding tool to open a pull request rather than push changes directly to the main branch. This is what makes DryRun Security scanning possible. DryRun Security analyzes pull requests in real time. If code is pushed directly to main, there is no pull request to scan and no opportunity to catch vulnerabilities before they land.

Review #

The skill gives the AI coding tool awareness that DryRun Security will scan the open pull request and post findings as a comment in GitHub or GitLab. After the PR is opened, the AI polls for that comment, waits for findings to be posted, and presents each one to the developer. After every commit to the branch, the AI re-polls for new findings and presents them, keeping the developer informed throughout the lifecycle of the PR.

Remediate #

When the developer wants to fix a finding, the skill gives the AI coding tool additional context to work from: how DryRun Security identified the vulnerability, background on the vulnerability class, OWASP guidance, and relevant framework documentation. This context helps the AI produce a fix that is accurate, minimal, and appropriate for the codebase.

To start the Author and Review workflow, describe your change and include a prompt to open a pull request:

[Describe the change you want]. When ready, open a pull request.

To invoke Remediate, paste the DryRun Security finding directly:

Fix this DryRun Security finding: [paste the finding comment]

DeepScan and SCA Workflow #

DryRun Security also offers a skill (dryrun-finding-remediation) that extends remediation beyond open pull requests. Where the PR workflow surfaces findings on an active PR, Finding Remediation queries DryRun Security directly for vulnerabilities from DeepScan and SCA scans, including findings already merged into the main branch. The skill connects to the DryRun Security knowledge graph to surface additional context about each finding, then opens a new pull request with the fix applied against the current state of the codebase.

Requires an API access token set as an environment variable named DRYRUN_API_KEY. See the API Access Keys page for setup instructions.

To invoke DryRun Finding Remediation:

Help me review the findings for this repo's DeepScan

Installation #

Skills are installed using the following command:

npx skills@latest add DryRunSecurity/external-plugin-marketplace

This installs all three DryRun Security skills, automatically detecting the agent in the current environment and placing the correct skill files in the appropriate location. Visit Settings > Integrations in the DryRun Security dashboard for agent-specific install instructions.

DryRun Finding Remediation requires an API access token to function. The skill installs as part of the standard command above, but set the token in your environment before using it:

DRYRUN_API_KEY=your_token_here

See the API Access Keys page for instructions on generating a token.