scan

Run Semgrep, Trivy, osv-scanner, and Bandit to identify security vulnerabilities.

98|10|Updated Feb 16, 2026

Search Tags:#security #vulnerability #codebase #owasp #scan #semgrep #trivy

Ready to run

npx skills add https://github.com/jiayaoqijia/eth2030 --skill scan-jiayaoqijia

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: scan
Source: https://github.com/jiayaoqijia/eth2030/tree/main/.claude/skills/scan
Command: npx skills add https://github.com/jiayaoqijia/eth2030 --skill scan-jiayaoqijia

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Run consolidated security scans across multiple engines to identify vulnerabilities in a codebase and produce a structured report.

Core Features & Use Cases

Multi-engine scanning: Execute Semgrep, Trivy, osv-scanner, and Bandit (where applicable) in parallel to surface vulnerabilities.
Structured output: Produce a machine-readable report with severities, file paths, and OWASP mappings.
Use Case: Integrate into CI to fail builds on critical findings or export findings to a dashboard for triage.

Quick Start

Run a security scan on the current project directory and return a structured report.

Frequently Asked Questions about scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I run a security vulnerability scan on a codebase using multiple engines?▼

To run a security vulnerability scan on a codebase, you can execute Semgrep, Trivy, osv-scanner, and Bandit in parallel across a target directory. This consolidates findings into a single structured report with severities and OWASP mappings.

Can I integrate multi-engine codebase security scanning into CI to fail builds on critical findings?▼

Yes, you can integrate multi-engine codebase security scanning into CI pipelines to fail builds on critical findings. The scanners produce a machine-readable JSON report that can be evaluated by CI rules or exported to a dashboard for triage.

What is the best way to identify OWASP vulnerabilities in a code repository?▼

The best way to identify OWASP vulnerabilities in a code repository is running a unified scan across multiple engines like Semgrep and Bandit. This approach surfaces diverse vulnerabilities and aligns them with OWASP categories in a structured JSON report.

Does unified security scanning support engine-specific runs for different package ecosystems?▼

Unified security scanning supports engine-specific runs across languages and package ecosystems. You can target a specific directory or repository for a full scan, or isolate the execution to individual engines where applicable.

How does parallel security scanning generate structured reports for codebases?▼

Parallel security scanning generates structured reports by running Semgrep, Trivy, osv-scanner, and Bandit concurrently, then aggregating the results. The output is a machine-readable JSON file containing severity mappings, file paths, and OWASP alignments.

Why use multiple codebase scanners instead of a single security tool?▼

Using multiple codebase scanners like Semgrep, Trivy, osv-scanner, and Bandit surfaces a wider range of vulnerabilities across different languages and package ecosystems. This consolidated approach ensures broader security coverage and structured OWASP-aligned reporting.