security-scan

Automate security analysis to detect secrets, vulnerabilities, and insecure patterns.

2|Updated Jan 29, 2026
One-click install
npx skills add https://github.com/DonTizi/CodeGeass --skill security-scan-dontizi
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: security-scan
Source: https://github.com/DonTizi/CodeGeass/tree/main/.claude/skills/security-scan
Command: npx skills add https://github.com/DonTizi/CodeGeass --skill security-scan-dontizi

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill automates a thorough security analysis of a codebase, helping teams identify secrets, vulnerabilities, and insecure patterns early in the development lifecycle.

Core Features & Use Cases

  • Secrets detection: locate API keys, tokens, passwords, and private keys in source code and configuration files.
  • Dependency vulnerability scanning: run tools like pip-audit and npm audit to surface vulnerable or outdated packages.
  • Code & configuration vulnerabilities: detect insecure patterns, misconfigurations, and risky behaviors in code and deployment configs.
  • Use Case: A security engineer scans a repo before a release to produce a risk report and remediation recommendations.

Quick Start

Run the security-scan tool on your repository to generate a comprehensive security report.

Frequently Asked Questions about security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan a codebase for vulnerabilities and exposed secrets?

To scan a codebase for vulnerabilities and secrets, you can automate security analysis using configurable rules to detect API keys, tokens, insecure patterns, and risky configurations across multiple languages and repositories.

What is the best way to detect hardcoded API keys in source code before a release?

The best way to detect hardcoded API keys is by running an automated security scan that applies configurable rules to locate secrets, passwords, and private keys hidden in source code and configuration files.

Can I audit vulnerable dependencies in my repository with a security scan?

Yes, a security scan can audit vulnerable dependencies by running tools like pip-audit and npm audit to surface vulnerable or outdated packages within your repository's dependency tree.

Does this automated code analysis support scanning across multiple programming languages?

Yes, the security analysis applies across languages and repositories, allowing you to detect insecure patterns, misconfigurations, and potential data exposure regardless of the specific programming language used.

How do I generate a risk report with remediation recommendations for my repository?

You can generate a comprehensive risk report with remediation recommendations by running an automated security scan on your repository to identify secrets, vulnerabilities, and insecure patterns early in the lifecycle.

What types of insecure configurations can a codebase security scan detect?

A codebase security scan can detect insecure configurations, misconfigurations in deployment files, risky behavioral patterns, and potential data exposure issues through configurable scanning rules.