scanning-vulns

Name: scanning-vulns
Availability: InStock
Author: Socket

Scan source files for static vulnerabilities and output VULN-FINDINGS.json and Markdown.

125|42|Updated May 19, 2025

Search Tags:#static-analysis #code-review #read-only #security-review #vulnerability-scan #triaging-findings

Ready to run

npx skills add https://github.com/SocketDev/socket-mcp --skill scanning-vulns

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: scanning-vulns
Source: https://github.com/SocketDev/socket-mcp/tree/main/.claude/skills/fleet/scanning-vulns
Command: npx skills add https://github.com/SocketDev/socket-mcp --skill scanning-vulns

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Static vulnerability review of a source tree to surface candidate vulnerabilities without executing the code, enabling safe triage and focused remediation planning.

Core Features & Use Cases

Reads an arbitrary codebase or dependency tree and surfaces candidate vulnerabilities for triage.
Produces VULN-FINDINGS.json consumable by triaging-findings and a human-readable Markdown summary for quick review.
Provides safe, read-only analysis with clear guidance on suspected issues and confidence levels.

Quick Start

Invoke scanning-vulns on a target directory to produce VULN-FINDINGS.json and a readable findings Markdown.

Frequently Asked Questions about scanning-vulns

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I run a static vulnerability scan on a source tree without executing the code?▼

Static vulnerability scanning analyzes arbitrary codebases read-only to surface credible vulnerabilities without executing code. It generates VULN-FINDINGS.json and a human-readable Markdown summary to enable safe triage and focused remediation planning.

What output formats are generated when scanning a codebase for vulnerabilities?▼

Codebase vulnerability scanning produces VULN-FINDINGS.json for automated triaging and a human-readable Markdown summary for quick review. An optional scoring pass provides additional confidence evaluation for the suspected issues.

Can I review dependencies for security vulnerabilities using static analysis?▼

Yes, static analysis can review arbitrary dependency trees to surface candidate vulnerabilities for triage. The scanner reads source files read-only and provides clear guidance on suspected issues and confidence levels without executing the code.

Does static vulnerability scanning require setting up a specific environment to run safely?▼

Static vulnerability scanning requires no special execution environment because it operates entirely read-only. It safely analyzes arbitrary repositories by reading source files and enforcing non-execution to prevent any code from running.

What is the best way to triage static code review findings?▼

The best way to triage static code review findings is to use the generated VULN-FINDINGS.json output. This structured file is specifically designed to be consumable by triaging workflows for focused remediation planning.

Are there limitations to read-only vulnerability scans for arbitrary codebases?▼

Limitations of read-only vulnerability scans include the inability to detect runtime or dynamic issues since code is never executed. It surfaces candidate vulnerabilities statically, requiring further triage to confirm exploitability.