sc-lang-java

Detect Java/Kotlin security vulnerabilities in JVM project artifacts.

Updated Aug 23, 2026

Search Tags:#security #vulnerability #java #kotlin #deserialization #jndi #spel

Ready to run

npx skills add https://github.com/kocakburhan/emlakdefter --skill sc-lang-java-kocakburhan

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sc-lang-java
Source: https://github.com/kocakburhan/emlakdefter/tree/main/.agents/skills/security-check/skills/sc-lang-java
Command: npx skills add https://github.com/kocakburhan/emlakdefter --skill sc-lang-java-kocakburhan

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Java/Kotlin applications in the JVM ecosystem face security blind spots, especially around deserialization gadgets, JNDI injections, and misconfigurations that lead to remote code execution or data exposure. This skill provides a targeted security deep scan tailored to Java and Kotlin environments, enabling teams to quickly surface and remediate JVM-specific risks.

Core Features & Use Cases

Java/Kotlin-specific vulnerability detection: identifies anti-patterns such as insecure deserialization, JNDI injections, and Spring/Hibernate misconfigurations.
Actionable remediation guidance: maps findings to practical fixes aligned with a Java/Kotlin security checklist.
Activation-aware scanning: runs when Java or Kotlin is present in security reports and can integrate with architecture-driven workflows.

Quick Start

Run the scanner against your Java/Kotlin project to perform a JVM security deep scan.

Frequently Asked Questions about sc-lang-java

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan Java and Kotlin projects for JVM security vulnerabilities?▼

Java and Kotlin security vulnerabilities are identified by analyzing project artifacts for common anti-patterns. The scanner specifically targets insecure deserialization, JNDI injections, Spring Expression Language issues, and Actuator exposure across JVM stacks.

What types of Java deserialization and JNDI injection risks can automated scanning detect?▼

Automated scanning detects insecure deserialization gadgets and JNDI injections by analyzing project artifacts for known anti-patterns. It surfaces these JVM-specific risks to prevent remote code execution and data exposure in Java and Kotlin environments.

Can I scan Spring and Hibernate configurations for HQL injection and Actuator exposure?▼

Yes, you can scan Spring and Hibernate configurations for HQL injection and Actuator exposure. The scanner analyzes project artifacts to identify these specific misconfigurations and maps findings to actionable remediation guidance.

How do I fix SpEL injection and other JVM security blind spots after detection?▼

To fix SpEL injection and JVM security blind spots after detection, follow the actionable remediation guidance provided by the scan. Findings are mapped to practical fixes aligned with a standard Java and Kotlin security checklist.

Does JVM vulnerability scanning work without manual security checklists?▼

JVM vulnerability scanning requires a standard Java and Kotlin security checklist and safe defaults to function accurately. The scanner uses these checklists to map detected anti-patterns to actionable remediation guidance.