OpenText Fortify Skills

AI agent skills that teach Claude, GitHub Copilot and other AI agents how to use OpenText Fortify effectively — covering SAST/DAST/SCA scanning, vulnerability triage, audit workflows, CI/CD integration, FCLI commands and more.

Skills

Agents

Agents are multi-skill orchestrators that handle end-to-end workflows.

Prerequisites

• fcli installed and on your PATH — install instructions
• An active Fortify on Demand (FoD) or Software Security Center (SSC) account
• An AI assistant that supports Agent Skills (Claude Code, GitHub Copilot, Cursor, Gemini CLI, etc.)

Installation

Claude Code

Add the marketplace from GitHub, then install the plugin:

claude plugin marketplace add fortify/skills
claude plugin install fortify-skills@fortify

The plugin registers all nine skills and the onboarding agent automatically.

GitHub Copilot

Recommended: install the Fortify Code Security VS Code extension. It bundles all Fortify skills, can automatically install fcli, and adds full IDE integration (scanning, vulnerability review, Aviator AI remediation, and an optional fcli MCP server):

1. Open VS Code and search for Fortify Code Security in the Extensions panel, or install directly:

   ext install fortifyvsts.fortify-code-security
   

2. The extension registers all skills automatically and sets up GitHub Copilot Agent Mode integration.

Alternative: manual install. Copy the skills to your Copilot skills directory:

<user>/.copilot/skills/

This gives you the skills without the IDE features (scanning UI, vulnerability browser, Aviator inline fixes, MCP server).

OpenAI Codex

This repository includes a marketplace catalog at .agents/plugins/marketplace.json. When the repo is your current workspace, Codex discovers it automatically as a repo-scoped marketplace. Open the plugin directory, select OpenText Fortify, and install fortify-skills.

To make the plugin available across all workspaces, add an entry to your personal marketplace at ~/.agents/plugins/marketplace.json (create the file if it doesn't exist), replacing <path> with the absolute path to this directory:

{
  "name": "fortify",
  "interface": { "displayName": "OpenText Fortify" },
  "plugins": [
    {
      "name": "fortify-skills",
      "source": { "source": "local", "path": "<path>" },
      "policy": { "installation": "AVAILABLE", "authentication": "ON_INSTALL" },
      "category": "Security"
    }
  ]
}

Then restart Codex. The plugin registers all nine skills automatically.

Gemini CLI

Install directly from the GitHub repository:

gemini extensions install https://github.com/fortify/skills

The extension bundles all nine skills. Gemini CLI auto-discovers them and activates whichever skill is relevant to your task.

To test locally before publishing:

gemini extensions link /path/to/public

Other AI assistants

Any assistant that supports the Agent Skills standard can load skills from this directory. Point your assistant's skill path to the skills/ subdirectory.

Usage

Once installed, the skills activate automatically when relevant. Examples of prompts that trigger each skill:

Resources

• Fortify CLI (fcli) — GitHub
• Fortify on Demand documentation
• Software Security Center documentation

License

MIT