skills.rest
microsoft
microsoftOFFICIAL
Explore all skills by this author →
Website𝕏@OpenAtMicrosoftGitHub

scan-code

Scans Power Pages site source code and dependencies for security issues using opengrep and trivy.

808|167|Updated Jan 21, 2026
Search Tags:#static analysis#security scan#secret detection#trivy#dependency scanning#OpenGrep#Power Pages
One-click install
npx skills add https://github.com/microsoft/power-platform-skills --skill scan-code
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: scan-code
Source: https://github.com/microsoft/power-platform-skills/tree/main/plugins/power-pages/skills/scan-code
Command: npx skills add https://github.com/microsoft/power-platform-skills --skill scan-code

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Power Pages site projects can contain hard-coded secrets, vulnerable packages, unsafe code patterns, and license issues that are hard to spot manually. This Skill runs static analysis and dependency scanning on your project and presents findings grouped by category so you know exactly what to fix first.

Core Features & Use Cases

  • Static code analysis: Runs opengrep against your source files with Basic or Advanced rule depth (OWASP Top 10, CWE Top 25) to find unsafe code patterns.
  • Dependency, secret, and license scanning: Runs trivy to detect vulnerable packages, hard-coded credentials, and license compliance issues, with support for custom rules and ignore files.
  • Unified reporting: Normalizes both tools' output into a single findings list and renders a timestamped HTML report, with an agent-driven code review fallback when the tools are not installed.
  • Use Case: Before deploying a Power Pages site, ask for a security check of your code and packages; the Skill scans the project, summarizes findings by category, and suggests follow-up skills like /manage-headers or /audit-permissions.

Quick Start

Ask the assistant to check my Power Pages project for security problems and vulnerable packages.

Frequently Asked Questions about scan-code

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan my Power Pages project for security issues?▼

Invoke the scan-code skill from your Power Pages project; it locates the project root via powerpages.config.json, asks what to check (code, packages, or both) and how thoroughly, then runs the scans and summarizes findings by category.

What tools does the Power Pages code scan use?▼

It uses opengrep for static analysis of source code and trivy for dependency vulnerabilities, secrets, and license scanning. Both tools must be installed locally; the check-tools.js script verifies availability before scanning.

What if opengrep or trivy is not installed on my machine?▼

The skill offers an agent-driven review fallback where the AI reads your source files directly with Glob, Read, and Grep to flag common security patterns. This consumes a large amount of tokens, so it requires your explicit opt-in.

Can I customize the scan rules or ignore known findings?▼

Yes. Opengrep accepts custom rulesets via --rulesets, and trivy supports --secretConfig for custom secret patterns, --ignoreFile for suppressing findings, and --trivyConfig for license classification settings.

Are detected secrets shown in the scan report?▼

No. Secret values are never displayed anywhere, not even partially. Findings identify a secret by its type, file, and line number only, and any value that would otherwise appear is masked.

Related Skills

Explore More Software Engineering Skills→
microsoftmicrosoft
647

deploy-site

Automate Power Pages site deployment to PAC-managed environments with PAC CLI.

Official
Advanced
EverClawEverClaw

ClawdStrike

Audit OpenClaw deployments for exposed interfaces, tool policies, secrets, and network posture.

Official
Advanced
davila7davila7
30.5k

best-practices

Applies modern web development best practices for security, browser compatibility, and code quality.

Community
Intermediate
billydeeii136billydeeii136

codex

Automate code review with AI agents and a pass/fail gate.

Community
Advanced