security-scan

You can automate security checks across your codebase by triggering an on-demand scan or relying on automatic phase checkpoints. This process identifies dependency vulnerabilities, risky code patterns, and exposed secrets using your project's documented tooling.

The best way to scan for known CVEs in package dependencies is by running a dependency audit. This skill checks your package managers during phase checkpoints or on-demand scans to identify and document known vulnerabilities.

When project tooling is not available, secrets detection falls back to default secret scanning mechanisms. This ensures your codebase is still checked for exposed sensitive information even without custom project configurations.

Yes, you can run static analysis to identify risky code patterns on demand. By issuing a security scan command, the skill evaluates your codebase against static analysis rules to highlight potential security issues.

No, the security scan does not strictly require specific build scripts or logs to audit code, although it supports them. It uses project-documented tooling where available and applies default secret scanning when needed.