skills.rest
mvillmow
mvillmowCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

scan-vulnerabilities

Detect security vulnerabilities in code and dependencies with static analysis.

18|5|Updated Nov 3, 2025
Search Tags:#cybersecurity#security scan#sast#vulnerabilities#code security#dependency audit#cve
One-click install
npx skills add https://github.com/mvillmow/ProjectOdyssey --skill scan-vulnerabilities
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: scan-vulnerabilities
Source: https://github.com/mvillmow/ProjectOdyssey/tree/main/.claude/skills/tier-2/scan-vulnerabilities
Command: npx skills add https://github.com/mvillmow/ProjectOdyssey --skill scan-vulnerabilities

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires bandit, safety, semgrep.

What problem does it solve?

Unidentified security vulnerabilities in code and dependencies can lead to critical breaches, data loss, and reputational damage. Manual scanning is insufficient.

Core Features & Use Cases

  • Code Pattern Scanning: Identifies unsafe patterns like SQL injection, hardcoded secrets, and unvalidated input.
  • Dependency CVE Check: Scans for known vulnerabilities (CVEs) in project dependencies using tools like safety and bandit.
  • Use Case: As part of your CI/CD pipeline, use this skill to automatically scan your codebase and dependencies for vulnerabilities before every deployment, ensuring a secure release.

Quick Start

Use the scan-vulnerabilities skill to scan your project for security issues using Bandit and check dependencies with Safety.

Frequently Asked Questions about scan-vulnerabilities

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan my codebase for security vulnerabilities?▼

Scanning for security vulnerabilities detects unsafe code patterns, hardcoded secrets, and unvalidated input using static analysis tools like Bandit and Semgrep. Run the scan-vulnerabilities skill on your project to identify these issues with severity levels and recommended fixes.

Can I check my project dependencies for known CVEs?▼

Dependency vulnerability scanning checks your project dependencies against known CVEs using tools like Safety. The skill produces a prioritized report showing vulnerable versions, CVSS scores, and recommended updates.

When should I run security vulnerability scans in my CI/CD pipeline?▼

Run vulnerability scans before every deployment, during regular security audits, and when updating dependencies across repositories. Automated scanning in CI/CD catches vulnerabilities early and prevents insecure code from reaching production.

What vulnerabilities does static analysis detect?▼

Static analysis identifies unsafe patterns including SQL injection risks, hardcoded secrets, unvalidated input handling, and other dangerous code patterns. It reports location, severity, and actionable remediation steps.

Does this work with Python projects and other languages?▼

Bandit specializes in Python code scanning, while Semgrep supports multiple languages including Python, JavaScript, Go, and Java. Safety audits Python dependencies; tool coverage depends on your project's language stack.

What's the difference between code scanning and dependency checking?▼

Code scanning detects unsafe patterns and logic flaws in your source code; dependency checking identifies known CVEs in third-party libraries. Both are essential—the skill combines them into a single prioritized report.

Related Skills

Explore More Software Engineering Skills→
glwrglwr
1

security

Audits Apple platform codebases for vulnerabilities and security risks.

Community
Advanced
randalmurphalrandalmurphal

Vulnerability Triage & Prioritization

Compute CVSS scores and prioritize vulnerabilities with weighted ranking.

Community
Basic
Lobbi-DocsLobbi-Docs
18

Container Security

Audit and harden container images and runtimes for vulnerabilities and misconfigurations.

Official
Advanced
wojonswojons
4

testing-security

Test applications and infrastructure for security vulnerabilities and weaknesses.

Community
Advanced