skills.rest
Corvalis-LLC
Corvalis-LLCOFFICIAL
Explore all skills by this author →
GitHub

security-scan

Scan Node.js codebases for security vulnerabilities and output a JSON report.

6|Updated Mar 31, 2026
Search Tags:#security#vulnerability#codebase#dependencies#scan#semgrep#npm-audit
One-click install
npx skills add https://github.com/Corvalis-LLC/Crow-Stack --skill security-scan-corvalis-llc
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-scan
Source: https://github.com/Corvalis-LLC/Crow-Stack/tree/main/skills/security-scan
Command: npx skills add https://github.com/Corvalis-LLC/Crow-Stack --skill security-scan-corvalis-llc

SYSTEM DOCUMENTATION & REQUIREMENTS

## What problem does it solve? Identify security vulnerabilities in codebases by applying automated scanning to detect insecure patterns, misconfigurations, and vulnerable dependencies, reducing risk before deployment.

## Core Features & Use Cases

  • Custom regex scanner for dangerous patterns and secrets
  • npm audit integration to surface vulnerable dependencies
  • Semgrep support to enforce OWASP security rules and project-specific policies (when available)

### Quick Start Run the security scanner against your codebase to detect vulnerabilities.

Frequently Asked Questions about security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan my Node.js codebase for security vulnerabilities?▼

To scan a Node.js codebase for security vulnerabilities, run the automated scanner against your project. It detects insecure patterns and vulnerable dependencies using npm audit, Semgrep, and custom regex, outputting a JSON vulnerability report.

Can I use Semgrep to enforce OWASP security rules in my CI workflows?▼

Yes, you can enforce OWASP security rules in CI workflows using Semgrep. The scanner integrates Semgrep support when available to detect insecure patterns and project-specific policy violations, reducing deployment risk.

Do I need a Node.js runtime to run an automated security scan?▼

Yes, a Node.js runtime is required to perform this automated security scan. The tool is built for Node.js projects and uses this environment to run npm audit and scan source code for dangerous patterns.

What is the best way to detect vulnerable npm dependencies before deployment?▼

The best way to detect vulnerable npm dependencies before deployment is using an automated scanner with npm audit integration. It surfaces vulnerable dependencies alongside insecure code patterns and outputs a JSON vulnerability report.

How does a custom regex scanner identify dangerous patterns and secrets?▼

A custom regex scanner identifies dangerous patterns and secrets by applying automated regex rules to the codebase. It detects hardcoded secrets and insecure configurations, reducing security risks before deployment.

Related Skills

Explore More Software Engineering Skills→
winsorllcwinsorllc

dependency-scanner

Scan package.json dependencies for outdated versions, vulnerabilities, and compatibility issues.

Community
Intermediate
Dhruvipatel0514Dhruvipatel0514
1

reporter

Consolidates vulnerability findings, threat intel, and audit results into a professional security report.

Community
Advanced
DonTiziDonTizi
2

security-audit

Scan codebases for secrets, OWASP risks, and vulnerable dependencies.

Community
Advanced
statick88statick88
1

security-auditor

Scan codebases for security vulnerabilities, dependency issues, and secret exposure.

Community
Advanced