DryRun Skill

AI coding tools are fast, but they operate in a silo. Left to their defaults, they may skip pull requests, ignore organizational best practices, and even when a PR is opened, they will not check for security findings unless explicitly told to. The DryRun Security skill closes that gap, giving the AI the context it needs to follow proper PR workflow and treat security findings as a required step in the process.

For findings from DeepScan and SCA scans, the DryRun Finding Remediation skill provides an additional workflow for actioning vulnerabilities outside of an open pull request.

Works with Claude Code, Codex, Cursor, Windsurf, and VS Code.

The PR Workflow #

The DryRun Security skill equips your AI coding tool with the context it needs to author, review, and remediate code securely across the lifecycle of a pull request.

Note: For most AI coding tools this workflow is packaged as a single skill. For Claude Code, it is split across two skills: dryrun-pr-review covering Author and Review, and dryrun-remediation covering Remediate. The workflow and experience are the same either way.

Author #

The skill instructs the AI coding tool to open a pull request rather than push changes directly to the main branch. This is what makes DryRun Security scanning possible. DryRun Security analyzes pull requests in real time. If code is pushed directly to main, there is no pull request to scan and no opportunity to catch vulnerabilities before they land.

Review #

The skill gives the AI coding tool awareness that DryRun Security will scan the open pull request and post findings as a comment in GitHub or GitLab. After the PR is opened, the AI polls for that comment, waits for findings to be posted, and presents each one to the developer. After every commit to the branch, the AI re-polls for new findings and presents them, keeping the developer informed throughout the lifecycle of the PR.

Remediate #

When the developer wants to fix a finding, the skill gives the AI coding tool additional context to work from: how DryRun Security identified the vulnerability, background on the vulnerability class, OWASP guidance, and relevant framework documentation. This context helps the AI produce a fix that is accurate, minimal, and appropriate for the codebase.

To start the Author and Review workflow, describe your change and include a prompt to open a pull request:

[Describe the change you want]. When ready, open a pull request.

To invoke Remediate, paste the DryRun Security finding directly:

Fix this DryRun Security finding: [paste the finding comment]

DeepScan and SCA Workflow #

DryRun Security also offers a skill (dryrun-finding-remediation) that extends remediation beyond open pull requests. Where the PR workflow surfaces findings on an active PR, Finding Remediation queries DryRun Security directly for vulnerabilities from DeepScan and SCA scans, including findings already merged into the main branch. The AI then opens a new pull request with the fix applied against the current state of the codebase.

Requires an API access token set as an environment variable named DRYRUN_API_KEY. See the API Access Keys page for setup instructions.

To invoke DryRun Finding Remediation:

Help me review the findings for this repo's DeepScan

Installation #

Install instructions for each tool are available in the DryRun Security dashboard under Settings > Integrations.

For DryRun Finding Remediation, set your API access token in your environment before installing the skill:

DRYRUN_API_KEY=your_token_here

See the API Access Keys page for instructions on generating a token.