security-scan

Name: security-scan
Availability: InStock
Author: cheafi

Scan code changes for secrets, vulnerable dependencies, and security regressions.

Updated Feb 23, 2026

Search Tags:#security #input validation #dependency audit #auth check #secret scanning #vulnerability review #pre-PR workflow

Ready to run

npx skills add https://github.com/cheafi/Trading-bot-CC --skill security-scan-cheafi

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-scan
Source: https://github.com/cheafi/Trading-bot-CC/tree/main/.github/skills/security-scan
Command: npx skills add https://github.com/cheafi/Trading-bot-CC --skill security-scan-cheafi

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill reduces the risk of shipping insecure code by providing a fast, repeatable security sweep that catches common secret leaks, dependency vulnerabilities, and basic auth/input validation issues early in the development workflow.

Core Features & Use Cases

Secrets scanning: Detects hardcoded credentials and API keys (including .env leakage checks) and blocks commits when matches are found.
Dependency audit: Reviews high/critical CVEs using language-appropriate tooling and reports affected packages.
Focused security spot-checks: Verifies input validation/sanitization, parameterized data access, file path traversal protections, and auth/authz ordering on changed routes.

Quick Start

Run the security-scan workflow to scan recent git changes for secrets, perform a dependency audit, and produce a CLEAN/NEEDS ATTENTION/BLOCKER security verdict.

Frequently Asked Questions about security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan code changes for exposed secrets before a pull request?▼

To scan code changes for exposed secrets before a pull request, run this workflow to perform a scoped scan of recent git changes, detect hardcoded credentials, and output a blocking verdict if matches are found.

What is the best way to check for dependency vulnerabilities and auth issues pre-commit?▼

Checking for dependency vulnerabilities and auth issues pre-commit involves running a focused security spot-check that reviews high and critical CVEs while validating authentication behavior and user input handling on changed routes.

Does this security scan detect .env file leakage and API keys in modified code?▼

Yes, this security scan detects .env file leakage and hardcoded API keys by sweeping recent commits and producing a structured security report that blocks commits when exposed credentials are identified.

Can I use this to verify input validation and path traversal protections on modified routes?▼

You can use this to verify input validation, parameterized data access, and file path traversal protections by applying a focused security spot-check specifically scoped to your modified API integrations and data storage routes.

What limitations should I expect when running a pre-PR dependency audit?▼

A limitation of running a pre-PR dependency audit here is that it focuses strictly on high and critical CVEs using language-appropriate tooling for affected packages, rather than providing a comprehensive, low-severity historical analysis.

How does the security review workflow output its verdict for blocked commits?▼

The security review workflow outputs its verdict for blocked commits by generating a structured security report that classifies changes as CLEAN, NEEDS ATTENTION, or BLOCKER based on the severity of detected vulnerabilities or exposed secrets.