skills.rest
noname300989
noname300989COMMUNITY
Explore all skills by this author →
GitHub

code-analysis

Analyze source code and running applications for security vulnerabilities.

Updated Aug 27, 2026
Search Tags:#code analysis#security#vulnerability#secrets#sast#sca#dast
One-click install
npx skills add https://github.com/noname300989/Security-Claw --skill code-analysis-noname300989
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: code-analysis
Source: https://github.com/noname300989/Security-Claw/tree/main/skills/code-analysis
Command: npx skills add https://github.com/noname300989/Security-Claw --skill code-analysis-noname300989

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill identifies security vulnerabilities within application source code and running systems, preventing potential breaches and ensuring code integrity.

Core Features & Use Cases

  • Static Analysis (SAST): Detects vulnerabilities like SQL injection, hardcoded secrets, and insecure patterns in code.
  • Dynamic Analysis (DAST): Tests running applications for exploitable weaknesses.
  • Dependency Scanning (SCA): Identifies known vulnerabilities in project dependencies.
  • Secret Detection: Finds accidentally committed API keys and credentials.
  • Use Case: A developer can use this Skill to scan their new Python codebase for common security flaws before deployment, ensuring a more secure application.

Quick Start

Scan the /src directory for OWASP Top 10 vulnerabilities using Semgrep.

Frequently Asked Questions about code-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find security vulnerabilities in my source code?▼

To find security vulnerabilities in your source code, you can perform static analysis using tools like Semgrep and Bandit. This identifies issues such as SQL injection, hardcoded secrets, and insecure patterns before deployment.

What is the difference between SAST, DAST, and SCA?▼

SAST detects insecure patterns in static source code, DAST tests running applications for exploitable weaknesses, and SCA identifies known vulnerabilities in project dependencies.

Can I scan a Python codebase for hardcoded API keys and credentials?▼

Yes, you can scan a Python codebase for hardcoded API keys and credentials using secret detection tools like TruffleHog and Gitleaks, which find accidentally committed sensitive information.

Does this code analysis approach support JavaScript and Java?▼

Yes, this code analysis approach supports multiple languages including JavaScript, Java, Python, Go, PHP, Ruby, and TypeScript for identifying OWASP Top 10 vulnerabilities and insecure patterns.

What's the best way to test a running application for exploitable weaknesses?▼

The best way to test a running application for exploitable weaknesses is performing dynamic analysis with tools like nuclei and ZAP, which actively probe your live systems for security flaws.

Why do I need dependency scanning for my project?▼

You need dependency scanning to identify known CVE vulnerabilities in your project dependencies. Using tools like OWASP Dependency-Check prevents potential breaches caused by outdated or flawed third-party libraries.

Related Skills

Explore More Software Engineering Skills→
froggugugugufroggugugugu

security-scan

Execute SCA, SAST, DAST, and secret detection scans to report vulnerabilities.

Community
Advanced
micaelmaltamicaelmalta
1

security-reviewer

Identify and remediate security vulnerabilities across code, configuration, and architecture.

Community
Advanced
Tashima-TarshTashima-Tarsh
1

devops-deploy

Validate DISHA production deployments against security, compliance, and CI/CD requirements.

Community
Advanced
davpatel605-beepdavpatel605-beep

web-pentest

Perform authorized web application penetration testing with structured vulnerability classification and reporting.

Community
Advanced