skills.rest
Sahib-Sawhney-WH
Sahib-Sawhney-WHCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

dapr-security-scanner

Audit DAPR component YAML files for security risks and generate remediation reports.

4|3|Updated Dec 24, 2025
Search Tags:#security#yaml#secrets#mtls#scanning#secretKeyRef
One-click install
npx skills add https://github.com/Sahib-Sawhney-WH/dapr-claude-plugin --skill dapr-security-scanner
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dapr-security-scanner
Source: https://github.com/Sahib-Sawhney-WH/dapr-claude-plugin/tree/main/skills/security-scanner
Command: npx skills add https://github.com/Sahib-Sawhney-WH/dapr-claude-plugin --skill dapr-security-scanner

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Proactively scan DAPR configurations for security vulnerabilities and best-practice violations, helping you fix exposures before they reach production.

Core Features & Use Cases

  • Plain-text secrets detection: Flags credentials left in YAML values.
  • Secret store references: Encourages using secretKeyRef for sensitive data.
  • Scope & access checks: Recommends scopes and proper access control for secret stores.
  • Auto-fix ideas: Suggests concrete changes to improve security posture.

Quick Start

Run the security scanner on components/ to generate a report and apply recommended fixes before deployment.

Frequently Asked Questions about dapr-security-scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find plain-text secrets in DAPR configuration files?▼

Plain-text secrets detection flags credentials left directly in YAML values, including base64-encoded data. The scanner audits component files to identify exposed secrets and recommends migrating them to secretKeyRef references for secure storage.

What security checks does DAPR configuration scanning cover?▼

DAPR security scanning audits plain-text secrets, missing ACLs, insecure configurations, mTLS settings, resiliency policies, and scope validation. It identifies violations of security best practices in component YAML files and secret store configurations.

How do I enforce secretKeyRef usage instead of storing secrets in DAPR configs?▼

The scanner flags inline credentials and recommends secretKeyRef for secret store references, enforcing proper scope and access control. It generates concrete remediation suggestions to migrate sensitive data out of component YAML.

Can I run security checks on DAPR configs before deployment?▼

Yes, the scanner generates reports with detected vulnerabilities and auto-fix guidance for pre-deployment validation. Run it on your components/ directory to identify and resolve security exposures before production rollout.

Does DAPR security scanning verify mTLS and access control configurations?▼

Yes, the scanner validates mTLS configurations, ACL settings, and access controls across secret stores and components. It recommends managed identity over connection strings and checks resiliency policies for security compliance.

Related Skills

Explore More Software Engineering Skills→
Sahib-Sawhney-WHSahib-Sawhney-WH
4

dapr-config-validator

Validate DAPR configuration files for schema compliance and misconfigurations.

Community
Advanced
ZaibunisZaibunis

kubernetes-basics-advanced

Generate Kubernetes YAML manifests for microservices with Dapr integration.

Community
Advanced
sjinkssjinks

security-review-owasp-infrastructure-as-code-security

Review Infrastructure as Code security controls for privilege, isolation, and deployment weaknesses.

Community
Advanced
devendrapratapsinghdevendrapratapsingh
1

platform-security

Audit container images, Kubernetes configurations, cloud environments, and infrastructure as code for security vulnerabilities.

Community
Advanced