Skip to content
Get packs

Guide · Agent skill

How to use the DefectDojo Vulnerability Dashboard agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This page explains how to install and use the DefectDojo Vulnerability Dashboard agent skill, a playbook that gives an AI agent step-by-step guidance for deploying DefectDojo and feeding it results from security scanners. DefectDojo is an open-source vulnerability management platform. After reading, you should know what the skill does, how to add it to your agent, how to ask for help with it, and what to check before running its scripts.

DefectDojo Vulnerability Dashboardmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Download and unzip the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use or into .claude/skills/ in a project. In the Claude apps, you can upload it under Settings, then Capabilities, then Skills.
  2. 2Check the prerequisites. Confirm you have Docker and Docker Compose, Python 3.9+ with requests, and a host with 4GB+ RAM, 2+ CPU cores and 20GB+ disk.
  3. 3Start DefectDojo. Clone the DefectDojo repository and start it with Docker Compose. The source says the admin credentials appear in the initializer logs, and DefectDojo is available at http://localhost:8080.
  4. 4Set your API key. Store your DefectDojo API key in the DEFECTDOJO_API_KEY or DD_API_KEY environment variable so the scripts can read it.
  5. 5Ask the agent to create your structure. Describe your business unit, application and assessment, and ask the agent to create the product type, product and engagement.
  6. 6Import your first scan. Upload one scanner report through the reimport-scan endpoint, then check the findings and deduplication results in DefectDojo.

What does the DefectDojo Vulnerability Dashboard skill make the agent do?

Once installed, the agent can walk you through deploying DefectDojo as a central vulnerability dashboard. It can help you create the product and engagement structure, upload scan reports through the REST API, wire up Jira ticketing and Slack alerts, and pull finding counts for dashboards.

The skill also includes two Python scripts that query and automate DefectDojo through its API. The skill is meant for consolidating output from many scanners, such as Nessus, ZAP, Trivy and Semgrep, into one place.

  • Deploy DefectDojo with Docker Compose
  • Create product types, products and engagements
  • Import scan results from 200+ scanners through the REST API
  • Deduplicate results and track remediation metrics
  • Integrate with CI/CD, Jira ticketing and Slack notifications
  • Run two bundled Python scripts that query and automate DefectDojo

How do you install the DefectDojo agent skill?

Download the ZIP file for this skill from this page. Unzip it into one of the locations below. The skill folder contains SKILL.md, the scripts folder, the references folder and the assets folder.

For a personal skill that applies across your projects, unzip it into ~/.claude/skills/. For a skill that applies to one project, unzip it into .claude/skills/ inside that project. In the Claude apps, you can instead upload the skill under Settings, then Capabilities, then Skills.

  • Personal: ~/.claude/skills/
  • Single project: .claude/skills/ inside your project folder
  • Claude apps: Settings → Capabilities → Skills, then upload

How do you trigger the skill with a natural request?

You do not need a special command. The skill is meant to be used when your request matches its description: consolidating scanner output into one dashboard, or automating vulnerability ticketing and executive reporting. Describe your goal in plain language and name the scanners and tools you use.

Good requests state the goal, the scanners and any integrations. Examples are below.

  • Help me deploy DefectDojo and set up a product for our customer portal.
  • Walk me through importing our Nessus and Trivy reports into one engagement.
  • Show me how to send new high-severity findings from DefectDojo to Jira.
  • How do I pull finding counts and SLA breach counts from DefectDojo for an executive report?

How does a scanner import work?

The core workflow is to start DefectDojo, create a product type, product and engagement, then upload each scanner report to the reimport-scan endpoint with the matching scan type string. The source describes a hierarchy of Product Type, Product, Engagement, Test and Finding, so each uploaded scan becomes a test under an engagement.

The example below uploads a Nessus report. Replace the file name and names with your own values. Other scanners use the same pattern with a different scan_type string, such as ZAP Scan or Trivy Scan.

  • Hierarchy: Product Type, then Product, then Engagement, then Test (one scanner run), then Finding (one vulnerability)
  • Scan type strings must match the DefectDojo name exactly, for example Nessus Scan or Semgrep JSON Report
curl -X POST "${DD_URL}/reimport-scan/" -H "Authorization: Token ${API_KEY}" -F "scan_type=Nessus Scan" -F "file=@nessus_report.csv" -F "product_name=Customer Portal" -F "engagement_name=Q1 2024 Security Assessment" -F "auto_create_context=true" -F "deduplication_on_engagement=true"

What do you need before you start?

The skill needs a Docker-based DefectDojo deployment, Python for the scripts, and an API key. Jira and Slack are optional and only needed if you want ticketing or alerts. The source recommends a host with 4GB+ RAM, 2+ CPU cores and 20GB+ disk.

  • Docker and Docker Compose
  • Python 3.9+ with the requests library
  • PostgreSQL 12+ (included in the Docker deployment)
  • DefectDojo API key, set as environment variable DEFECTDOJO_API_KEY or DD_API_KEY
  • Optional: Jira instance with API token
  • Optional: Slack webhook
  • Host with 4GB+ RAM, 2+ CPU cores and 20GB+ disk

What safety issues should you check before running the scripts?

This skill runs scripts and uses the network. The scripts read API keys from environment variables, so keep credentials out of the script files. The examples in the skill contain placeholder passwords and keys that must be replaced with your own secure values.

The skill's SKILL.md sets DD_ALLOWED_HOSTS to a wildcard. The source does not present this as a production setting, and the scripts are described as minimal examples. Do not treat this skill as a turnkey, production-hardened deployment.

  • Read the scripts before running them, especially if your environment restricts script execution
  • Store the API key in an environment variable, not in code or chat
  • Replace all placeholder values such as <secure_password> and <random_64_char_key>
  • Review DD_ALLOWED_HOSTS=* before exposing DefectDojo beyond a test host
  • Be aware that the scripts and API calls send traffic over the network

What tips help you get the most from the skill?

Start with one scanner and one engagement so you can confirm the import works before adding more. The skill's examples use different variable names for the API key, such as API_KEY and DEFECTDOJO_TOKEN, so use the one your script reads. The reference files list the main API endpoints and finding query parameters, which helps when you ask follow-up questions.

  • Check the scanner table in the skill for the exact scan type string
  • Use the active=true filter when counting open findings
  • Use the template in assets for product type and SLA setup
  • Check references/api-reference.md for endpoints such as findings, products, engagements and tests

What people use it for

  • Consolidating Nessus, ZAP and Trivy results for one customer application into a single engagement
  • Uploading Semgrep results from a CI/CD pipeline into DefectDojo on each push
  • Sending new findings to Jira tickets with severity mapping
  • Pulling active finding counts and SLA breach counts for an executive report

Frequently asked questions

Is the DefectDojo agent skill free to use?

The skill is licensed under Apache-2.0, as listed on this page. The source describes DefectDojo as open source and lists its license as BSD-3-Clause. The source does not state any prices.

What do I need to install the DefectDojo agent skill?

You need to download and unzip the skill folder into your agent's skills location. To run DefectDojo itself, you need Docker, Docker Compose, Python 3.9+ with requests, and a host with 4GB+ RAM, 2+ CPU cores and 20GB+ disk.

Where do I put the skill folder?

Put it in ~/.claude/skills/ for personal use, or in .claude/skills/ inside a project for project-only use. In the Claude apps, upload it under Settings, then Capabilities, then Skills.

Does this skill need Jira or Slack?

No. The source lists Jira and Slack as optional. You only need a Jira API token or a Slack webhook if you want ticketing or alerts.

Can I use this skill in production?

The source does not present it as production-hardened. The SKILL.md sets DD_ALLOWED_HOSTS to a wildcard and the scripts are minimal examples, so review and harden the setup first.

How does DefectDojo compare with other vulnerability management tools?

The source does not compare DefectDojo with other tools. It describes DefectDojo as a platform that aggregates findings from 200+ security tools and deduplicates them, which is the main reason to choose it.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits security or DevOps teams that want one dashboard for findings from several scanners, and engineers who want to automate scan uploads from CI/CD. It is a poor fit for teams that run only one scanner, since DefectDojo adds real infrastructure overhead, and for environments that cannot run scripts or store API keys in environment variables. Treat it as a starting playbook, not a production deployment.

Download the skill