skills.rest
drvoss
drvossCOMMUNITY
Explore all skills by this author →
GitHub

security-scan

Scan code changes and dependencies for security vulnerabilities.

42|9|Updated Mar 16, 2026
Search Tags:#security#owasp#code-review#secret-detection#dependency-audit#configuration-security
One-click install
npx skills add https://github.com/drvoss/everything-copilot-cli --skill security-scan-drvoss
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-scan
Source: https://github.com/drvoss/everything-copilot-cli/tree/main/skills/security/security-scan
Command: npx skills add https://github.com/drvoss/everything-copilot-cli --skill security-scan-drvoss

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Use when you want a quick security pass on code changes or dependencies — checks OWASP Top 10 patterns, runs dependency audits, and surfaces critical vulnerabilities with targeted fixes.

Core Features & Use Cases

  • Dependency vulnerability audits across npm, pip, Go, and other ecosystems, surfacing high-risk packages and suggested remediations.
  • OWASP Top 10 code review for common patterns and insecure practices, helping teams harden code paths and authentication flows.
  • Secret/credential detection to surface hard-coded keys, tokens, and configs before they are committed.
  • Configuration security checks including debug exposure, CORS misconfig, and risky default settings to prevent misconfigurations.
  • Generated security reports that summarize findings by severity and provide targeted fixes for developers.

Quick Start

Run the security-scan on your codebase to perform a fast security pass and surface vulnerabilities.

Frequently Asked Questions about security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a dependency vulnerability audit across npm, pip, and Go ecosystems?▼

To run a dependency vulnerability audit across npm, pip, and Go, apply this security scan to your codebase. It surfaces high-risk packages and provides suggested remediations for vulnerable dependencies.

What is the best way to detect hard-coded secrets and credentials before committing code?▼

The best way to detect hard-coded secrets is using secret detection within a security workflow. It surfaces hard-coded keys, tokens, and configs before they are committed to your repository.

Can I check my code changes against OWASP Top 10 patterns during code review?▼

Yes, you can check code changes against OWASP Top 10 patterns during review. It identifies common insecure practices and helps harden code paths and authentication flows.

How do I scan for configuration security issues like CORS misconfigurations and debug exposure?▼

To scan for configuration security issues like CORS misconfig and debug exposure, run configuration security checks. It prevents misconfigurations by detecting risky default settings.

Does this security scan work with CI pipelines and Node, Python, or Go codebases?▼

This security scan works with CI pipelines and codebases across Node, Python, Go, and other ecosystems. It identifies vulnerabilities in dependency updates and code changes.

What is included in the generated security report after scanning my codebase?▼

The generated security report summarizes findings by severity after scanning your codebase. It provides targeted fixes for developers to resolve critical vulnerabilities quickly.

Related Skills

Explore More Software Engineering Skills→
hotaqhotaq

security-review

Audit codebases for OWASP Top 10 vulnerabilities and exposed secrets.

Community
Advanced
jpoleyjpoley
50

security-fixer

Generate secure patches for code vulnerabilities and output unified diffs.

Community
Intermediate
zircotezircote
1

security-baseline

Audit GitHub repositories for security gaps and implement baseline hardening.

Community
Advanced
kinnerkarmanishkinnerkarmanish

security-auditor

Detect vulnerabilities and misconfigurations across codebases using static analysis, dependency checks, and secret detection.

Community
Advanced