skills.rest
zebbern
zebbernCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

code-vuln-audit

Scan codebases for dependency vulnerabilities, leaked secrets, and OWASP anti-patterns.

4.6k|462|Updated Jun 21, 2025
Search Tags:#static analysis#owasp#security scan#npm audit#secret detection#vulnerability detection#pip-audit
One-click install
npx skills add https://github.com/zebbern/claude-code-guide --skill code-vuln-audit
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: code-vuln-audit
Source: https://github.com/zebbern/claude-code-guide/tree/main/skills/code-vuln-audit
Command: npx skills add https://github.com/zebbern/claude-code-guide --skill code-vuln-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Hardcoded API keys, outdated dependencies with known CVEs, and injection-prone code patterns often slip into repositories unnoticed. This Skill automates security scanning so you can catch these issues before they reach production.

Core Features & Use Cases

  • Dependency Vulnerability Scanning: Automatically detects Node.js and Python projects and runs npm audit or pip-audit to surface known vulnerabilities.
  • Secret Leak Detection: Finds hardcoded credentials (AWS keys, GitHub tokens, Stripe keys, private keys, JWTs) using regex patterns plus Shannon entropy analysis for non-standard secrets.
  • OWASP Pattern Detection: Flags SQL injection, XSS, command injection, weak cryptography, insecure deserialization, SSRF, and misconfigurations across Python, JavaScript/TypeScript, Java, PHP, Ruby, and Go.
  • Use Case: Before merging a pull request, run a full scan of the repository to confirm no secrets were committed and no new injection vulnerabilities were introduced, then export the findings as JSON for CI reporting.

Quick Start

Ask the assistant to run a security scan on the current project directory and report any high-severity findings.

Frequently Asked Questions about code-vuln-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan code for hardcoded secrets and API keys?▼

Run the security scan script in secrets mode against your project directory. It detects AWS keys, GitHub tokens, Slack tokens, Stripe keys, private keys, and JWTs via regex, plus uses Shannon entropy analysis to catch non-standard high-entropy strings.

How do I check npm and pip dependencies for known vulnerabilities?▼

Run the scan in deps mode. It auto-detects Node.js projects via package.json and package-lock.json to run npm audit, and Python projects via requirements.txt or pyproject.toml to run pip-audit, reporting each vulnerability with severity.

What OWASP vulnerabilities can static code scanning detect?▼

The scanner detects SQL injection, command injection, XSS patterns like innerHTML and dangerouslySetInnerHTML, weak hashes such as MD5 and SHA1, insecure deserialization via pickle or yaml.load, SSRF, path traversal, and misconfigurations like debug mode or CORS wildcards.

Does the security scanner work without npm or pip-audit installed?▼

Yes. If npm or pip-audit is missing, that dependency module is skipped with an informational message while the secrets and OWASP modules continue running normally. The core scanner only requires Python 3.7 or later with standard libraries.

Can I use the security scan in a CI pipeline?▼

Yes. Use JSON output format with the output file option and set a minimum severity threshold. The script exits with code 1 when findings exist and 0 when clean, making it suitable for gating CI jobs on security results.

What are the limitations of regex-based secret detection?▼

Regex patterns only catch known secret formats and may miss custom token schemes, while entropy analysis can produce false positives on legitimate random strings like hashes. Findings should be manually verified before rotating credentials.

Related Skills

Explore More Software Engineering Skills→
alxayoalxayo
17

guarddog-security-scan

Audit Python and Node.js dependencies for malware before installation.

Community
Intermediate
JimmyTranDevJimmyTranDev
1

security-npm-vulnerabilities

Triage npm audit vulnerabilities and plan safe dependency upgrades.

Community
Advanced
Logos-LiberLogos-Liber
17

vulnerability-scanning

Identifies security vulnerabilities in code, dependencies, and container images.

Official
Advanced
dandudzidandudzi
2

sast-configuration

Automate SAST tool selection, configuration, and CI/CD integration.

Community
Advanced