Scan code and dependencies for vulnerabilities mapped to CWEs.
npx skills add https://github.com/florianbuetow/claude-code --skill pasta-vulns
Please help me install this Agent Skill. Skill: pasta-vulns Source: https://github.com/florianbuetow/claude-code/tree/main/plugins/appsec/skills/pasta-vulns Command: npx skills add https://github.com/florianbuetow/claude-code --skill pasta-vulns
This Skill identifies specific weaknesses in code and configuration that could be exploited, mapping findings to CWE identifiers and correlating them with threat models.
Run a deep vulnerability analysis on the changed files, generating fix suggestions.
High-intent search queries and answers about installing and using this skill.
To scan code for security vulnerabilities and map them to CWE identifiers, you can use this Skill to run comprehensive application security analysis. It utilizes tools like semgrep, bandit, and gosec to identify weaknesses and correlates findings with threat catalogs.
PASTA threat modeling is a risk-centric methodology that this Skill supports by mapping identified code vulnerabilities to specific threats and attack vectors. It evaluates exploitability by considering complexity and existing controls to correlate findings with threat catalogs.
You can run SAST and DAST analysis on changed files to generate automated fix suggestions by initiating a deep vulnerability analysis. The Skill supports configurable depth options and automated fix generation for identified code and configuration weaknesses.
Yes, you can use semgrep, bandit, and gosec together for comprehensive application security testing. The Skill integrates these static analyzers alongside dependency and secret scanners like npm audit and trivy to identify common security flaws in code and configuration.
Yes, this vulnerability scanner supports secret and dependency scanning using trivy and npm audit. It performs comprehensive application security vulnerability analysis across code, dependencies, and secrets to identify exploitable weaknesses.
While automated SAST tools identify vulnerabilities, exploitability assessment limitations include relying on evaluated complexity and existing controls rather than runtime context. The Skill correlates static findings with threat models but may not capture all dynamic execution variables.
juniorfonteneleEnforce idiomatic Go patterns, quality gates, and testing guidelines for Go projects.
jota-batutaIdentify and remediate security risks in AI-generated code with threat modeling, OWASP, and secrets scanning.
Objective-ArtsReview authentication flows and system designs for security vulnerabilities.
Serg28Automate security audits with semgrep, trivy, gitleaks, and dependency scanners.
