scan-security

Detect hardcoded secrets, unsafe eval, and SQL injection risks in codebases.

Updated Aug 23, 2026

Search Tags:#automation #security #sql-injection #code-scanning #vulnerability-detection #hardcoded-secrets #eval-usage

Ready to run

npx skills add https://github.com/TrevorPLam/agency --skill scan-security

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: scan-security
Source: https://github.com/TrevorPLam/agency/tree/main/.windsurf/skills/scan-security
Command: npx skills add https://github.com/TrevorPLam/agency --skill scan-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Identifies security vulnerabilities in codebases during assessments by detecting hardcoded secrets, risky eval usage, and SQL injection risks, helping teams prevent insecure releases.

Core Features & Use Cases

Hardcoded secrets discovery across codebases to reduce credential leakage.
Detection of unsafe eval usage and dynamic code execution patterns.
SQL injection risk screening and guidance for secure remediation.
Excludes running during post-commit or active implementation phases to avoid interference.
Generates actionable findings and remediation guidance for security reviews.

Quick Start

Run the Windsurf security scan and paste the full terminal results into the Windsurf task log.

Frequently Asked Questions about scan-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan a codebase for hardcoded secrets and SQL injection risks?▼

To scan a codebase for hardcoded secrets and SQL injection risks, run the security scan to execute pattern-based searches across repositories. It identifies unsafe eval usage and generates per-finding hashes appended to tasks/issues.md with a structured remediation template.

What is the best way to detect unsafe eval usage during a security assessment?▼

Detecting unsafe eval usage during a security assessment requires pattern-based searches across your deployed components and CI workflows. This approach identifies dynamic code execution vulnerabilities and generates actionable remediation guidance for security reviews.

Does this security scan work during post-commit or active implementation phases?▼

No, this security scan does not work during post-commit or active implementation phases. It explicitly excludes running during these stages to avoid interfering with active development processes.

How do I track vulnerability findings across multiple repository scans?▼

You track vulnerability findings across repository scans by generating per-finding hashes. The scan appends these unique identifiers with a structured remediation template directly to tasks/issues.md.

Why should I exclude security scans from the post-commit phase?▼

You exclude security scans from the post-commit phase to avoid interfering with active implementation. Running vulnerability detection during active development disrupts workflows and generates noise.