scan

Invoke the scan skill with no arguments for a full repository scan, pass a path like src/auth for a targeted scan, or use --focus dependencies, sast, or config to limit the scan type. The skill detects your languages and runs the appropriate tools automatically.

For JavaScript it uses Semgrep, npm audit, and ESLint with the security plugin. For Python it uses Semgrep, pip-audit, and Bandit. Semgrep is preferred since it covers over 30 languages with OWASP and CWE rule packs.

Yes, the skill falls back to Grep-based pattern detection for SQL injection, XSS, and command injection when no SAST tools are installed. This fallback has higher false positives, so installing Semgrep is recommended for accurate results.

Findings are normalized to a unified scale where CVSS 9.0-10.0 is Critical, 7.0-8.9 is High, 4.0-6.9 is Medium, and below 4.0 is Low. Tool-specific severities from Semgrep, npm audit, and Bandit are mapped onto this scale.

Yes, results can be exported as JSON, HTML, or Markdown reports, and Critical or High findings can be converted into Jira issues with severity, OWASP category, and remediation guidance included. Scan history is stored locally for trend analysis.