skills.rest
antstanley
antstanleyCOMMUNITY
Explore all skills by this author →
GitHub

security-scan

Audits every file in a repository or scoped path and produces a sealed scan contract with findings, coverage, report, and SARIF.

Updated May 4, 2026
Search Tags:#code review#security audit#vulnerability scan#cwe#sarif#threat model#repository scan
One-click install
npx skills add https://github.com/antstanley/skills --skill security-scan-antstanley
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-scan
Source: https://github.com/antstanley/skills/tree/main/plugins/security/skills/security-scan
Command: npx skills add https://github.com/antstanley/skills --skill security-scan-antstanley

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Manual security review of an entire codebase is slow and inconsistent, and ad-hoc scans often skip files or lose track of which candidates were validated. This Skill runs a standard single-pass security audit that reviews every in-scope file, tracks every candidate in one ledger, and emits a sealed, machine-readable scan contract. ## Core Features & Use Cases - Full-file coverage: Builds an in-scope file list, reviews every file, and records candidates in a single normalized JSONL ledger so nothing is silently skipped. - Two compact analysis passes: Runs validation and attack-path analysis over the ledger to confirm bugs, establish reachability, and assign severity using a threat model. - Sealed artifacts: Finalization generates scan-manifest.json, findings.json, coverage.json, a Markdown report, and SARIF output for tooling integration. - Use Case: Point it at a repository or a scoped package directory before a release to get a complete audit of that code with a SARIF file you can upload to your code scanning dashboard. ## Quick Start Run a standard security scan of this repository and generate the findings report and SARIF output.

Frequently Asked Questions about security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security audit on an entire repository?▼

Invoke the security-scan skill with the target directory and optional scope. It builds an in-scope file list, reviews every file, validates candidates, runs attack-path analysis, and finalizes a sealed scan contract with a report and SARIF output.

What is the difference between a standard scan and a deep or diff scan?▼

A standard scan is a single-pass audit of a repository or scoped path with no diff to review. Diff scans cover PR, commit, branch, or working-tree changes, while deep scans add repeated multi-pass discovery; use those skills instead for those cases.

Can I scan only one package or folder instead of the whole repo?▼

Yes. Provide a scoped path, package, folder, or submodule as the target. The scan uses that scoped directory as the target and never silently widens the scope to the repository root.

What output files does the security scan produce?▼

The scan produces scan-manifest.json, findings.json, and coverage.json, then a finalizer generates report.md and SARIF. The report and SARIF are generated by the finalizer script and should not be edited by hand.

Why does the scan require a threat model before analysis?▼

The threat model is used during attack-path analysis to establish realistic reachability and severity for each validated candidate. You can run the threat-model skill first or supply an existing threat model, which is kept under the scan's context directory.

Related Skills

Explore More Software Engineering Skills→
HumandDevHumandDev

area-intake

Collect area objectives, repositories, dependencies, and constraints into a problem statement and checklist.

Official
Basic
glogaiglogai

glog

Scan codebases, validate SARIF results, and generate remediation reports.

Official
Advanced
openaiopenai
5.3k

attack-path-analysis

Trace security findings from source to sink and calibrate severity against a threat model.

Official
Advanced
openaiopenai
5.3k

deep-security-scan

Runs repeated independent repository-wide security scans and aggregates validated findings into canonical artifacts.

Official
Advanced