security-hygiene

To scan for exposed secrets before a merge, analyze repository contents to detect tokens, keys, and credentials. This skill inspects source code and suspicious files, generating actionable recommendations with evidence of the exposed secrets.

Checking GitHub Actions for insecure permissions involves analyzing workflow files for dangerous configurations and secret usage. This skill reviews your CI/CD setup to identify overly permissive workflows and provides concise risk recommendations.

Insecure coding patterns detected in Node.js and TypeScript include dangerous configurations and vulnerable code structures. The skill analyzes source files and package.json to identify these risks, delivering evidence-based recommendations focused on severity and impact.

You can detect dangerous configurations in CI/CD pipelines by analyzing GitHub Actions workflows and scripts. This skill inspects these files for insecure permissions and risky setups, outputting concise recommendations with evidence of the detected vulnerabilities.

The best way to identify security risks in GitHub Actions and package.json is to scan for exposed secrets, insecure permissions, and dangerous code patterns. This skill analyzes these files to generate evidence-based recommendations prioritized by severity.

A limitation of this repository security scan is its focus on basic security risks, targeting exposed secrets and dangerous configurations in Node.js, TypeScript, and GitHub Actions. It provides actionable recommendations but may not detect complex or language-specific vulnerabilities outside this scope.