使用说明
Veracode Skills
GitHub Copilot skills for Veracode security scanning workflows. Each skill is a pre-built prompt that knows which Veracode MCP tools to call for a specific task.
[!NOTE] As of October 2026, I no longer have a Veracode license, so I can't verify whether the following still works as Veracode's technology stack evolves.
Prerequisites
- The Veracode MCP server must be installed and configured in VS Code
- An authenticated Veracode account with API credentials configured
- GitHub Copilot with agent mode enabled in VS Code
Available Skills
| Skill | Trigger | What it does |
|---|---|---|
| scanit | /scanit |
Packages the workspace and starts a pipeline SAST scan |
| thirdit | /thirdit |
Runs a local SCA scan on third-party dependencies and checks IaC configurations |
| reportit | /reportit |
Retrieves findings and produces a prioritised executive summary |
Installation
Install for a project (team-shared, checked in to source control)
Copy the skill directories into your project's .claude/skills/ directory:
Windows:
Copy-Item -Recurse scanit, thirdit, reportit, fixit, explainit "<your-project>\.claude\skills\"
macOS/Linux:
cp -r scanit thirdit reportit fixit explainit <your-project>/.claude/skills/
Install for personal use across all projects
Windows:
Copy-Item -Recurse scanit, thirdit, reportit, fixit, explainit "$env:USERPROFILE\.claude\skills\"
macOS/Linux:
cp -r scanit thirdit reportit fixit explainit ~/.claude/skills/
After placing the directories, the skills are available immediately — no VS Code reload required.
Typical Workflow
# 1. Package and scan
/scanit
# 2. Review findings
/reportit
# 3. Scan dependencies and IaC separately
/thirdit
Note: Skills call MCP tools automatically based on your request. The Veracode MCP server must be running and configured in VS Code for skills to work.
See Also
- veracode-agents — VS Code Copilot agents for autonomous analysis and remediation loops
- veracode-mcp — The MCP server these skills connect to
