security-scan

Name: security-scan
Availability: InStock
Author: froggugugugu

Execute SCA, SAST, DAST, and secret detection scans to report vulnerabilities.

Updated Feb 7, 2026

Search Tags:#security #vulnerability #sast #secret detection #sca #dast

Ready to run

npx skills add https://github.com/froggugugugu/project-blueprints --skill security-scan-froggugugugu

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-scan
Source: https://github.com/froggugugugu/project-blueprints/tree/main/project-blueprint-en/.claude/skills/security-scan
Command: npx skills add https://github.com/froggugugugu/project-blueprints --skill security-scan-froggugugugu

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill identifies and reports security vulnerabilities in your codebase, helping you proactively address risks before they can be exploited.

Core Features & Use Cases

Comprehensive Scanning: Integrates SCA, SAST, DAST, and secret detection tools.
Vulnerability Reporting: Generates structured reports detailing findings, severity, and remediation steps.
Use Case: Before deploying a new feature, run this Skill to scan for common vulnerabilities like hardcoded secrets, dependency flaws, and injection risks, ensuring a more secure release.

Quick Start

Run a full security scan on the entire project.

Frequently Asked Questions about security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I run a full security scan for source code flaws and dependency vulnerabilities?▼

To scan for hardcoded secrets, this Skill integrates gitleaks to identify exposed credentials and sensitive information in your codebase. It reports findings with severity levels to help you proactively remediate hidden secrets before deployment.

Do I need Docker to perform DAST vulnerability scanning on my running application?▼

Yes, you need Docker to perform DAST vulnerability scanning on your running application. The Skill requires Docker to execute dynamic application security testing alongside tools like gitleaks and semgrep for comprehensive analysis.

What is the difference between SAST, SCA, DAST, and secret detection in automated vulnerability scanning?▼

In automated vulnerability scanning, SAST analyzes source code flaws, SCA checks dependency packages, DAST tests running applications, and secret detection finds exposed credentials. This Skill executes all four to address risks across your entire codebase.

Can I use semgrep and gitleaks to find injection risks and hardcoded secrets before deploying a feature?▼

Yes, you can use semgrep and gitleaks to find injection risks and hardcoded secrets before deploying a new feature. The Skill leverages these specific tools to scan your project and ensure a more secure release.

What's the best way to generate structured reports for security vulnerabilities and remediation steps?▼

The best way to generate structured vulnerability reports is to run an automated security scan that details findings, severity, and remediation steps. This Skill outputs comprehensive reports covering dependency flaws, source code issues, and exposed secrets.