security-fast-scan

Scan applications for OWASP Top 10 vulnerabilities and misconfigurations.

Updated Dec 23, 2025

Search Tags:#OWASP #security #dependencies #config #secrets #vulnerabilities #scan

Ready to run

npx skills add https://github.com/yaochangyu/ai-dev-toolkit --skill security-fast-scan

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-fast-scan
Source: https://github.com/yaochangyu/ai-dev-toolkit/tree/main/.github/skills/security-fast-scan
Command: npx skills add https://github.com/yaochangyu/ai-dev-toolkit --skill security-fast-scan

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill automates comprehensive application security scanning to identify OWASP Top 10 vulnerabilities, sensitive data leaks, dependency risks, and misconfigurations.

Core Features & Use Cases

Injection and XSS checks: Detect insecure coding patterns that enable SQL/Command Injection and XSS.
Sensitive data and config scanning: Identify hard-coded keys, API keys, passwords, and insecure configurations.
Dependency vulnerability checks: Inspect dependencies across Node.js, Go, and .NET ecosystems for known CVEs.

Quick Start

Run the full security-fast-scan across the repository with: @workspace run security-fast-scan To limit scope to a subdirectory, specify a target path, for example: target_path: src/

Frequently Asked Questions about security-fast-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan my codebase for OWASP Top 10 vulnerabilities and hardcoded secrets?▼

You can scan for OWASP Top 10 vulnerabilities and hardcoded secrets by running an automated security scan across your repository. It detects injection risks, sensitive data leaks, and misconfigurations, generating actionable reports for remediation.

How do I check dependencies for known CVEs in Node.js, Go, and .NET?▼

Checking dependencies for known CVEs in Node.js, Go, and .NET requires an automated vulnerability scanner. It inspects project dependency manifests to identify known risks and outputs a report highlighting vulnerable packages.

Can I run a security scan on a specific subdirectory instead of the whole project?▼

Yes, you can limit the security scan to a specific subdirectory instead of the whole project. By specifying a target path, the scanner restricts its scope to that directory, analyzing only the files within that boundary.

Does this security scan detect SQL injection, command injection, and XSS vulnerabilities?▼

Yes, the security scan detects SQL injection, command injection, and XSS vulnerabilities. It applies built-in pattern checks to identify insecure coding patterns across the project scope that enable these specific attacks.

What is the best way to automate application security checks in a CI/CD workflow?▼

The best way to automate application security checks in a CI/CD workflow is using a deterministic scanning tool. It executes pre-release checks for sensitive data leaks and dependency risks, generating actionable reports automatically.

Are there limitations to using built-in pattern checks for finding security vulnerabilities?▼

Built-in pattern checks for finding security vulnerabilities rely on deterministic rules, meaning they may miss complex or novel logical flaws. They are best suited for identifying known insecure coding patterns, hard-coded keys, and misconfigurations.