skills.rest
kvithayathil
kvithayathilCOMMUNITY
Explore all skills by this author →
GitHub

security-scan

Scan codebases with 17 SAST engines and generate Markdown reports.

Updated Apr 14, 2026
Search Tags:#sast#security scanning#vulnerability detection#dependency audit#secrets detection#iac security#ci/cd gating
One-click install
npx skills add https://github.com/kvithayathil/agent-resources --skill security-scan-kvithayathil
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-scan
Source: https://github.com/kvithayathil/agent-resources/tree/main/skills/security-scan
Command: npx skills add https://github.com/kvithayathil/agent-resources --skill security-scan-kvithayathil

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Manually running separate security scanning tools to check for code vulnerabilities, leaked secrets, dependency risks, and infrastructure misconfigurations is time-consuming, inconsistent, and often leads to missed critical issues across different parts of a codebase.

Core Features & Use Cases

  • Unified multi-engine scanning: Runs 17 SAST, secrets detection, dependency audit, and infrastructure-as-code security tools in a single command, eliminating the need to run and configure each tool individually.
  • Configurable scan profiles: Choose from preset profiles like fast (for dev feedback), secrets-only, deps-only, or full (for pre-release scans) to match your use case.
  • CI/CD security gating: Automatically fail pipelines on critical or high-severity findings, with clear exit codes and Markdown reports for easy integration into development workflows.
  • Use case: For a team preparing a Terraform-based cloud application for release, use this skill to run a full scan that catches Python code vulnerabilities, leaked secrets in git history, misconfigured infrastructure, and outdated dependency risks in one go.

Quick Start

Use the security-scan skill to run a full security scan of your project's codebase and get a report of all critical and high-severity findings.

Frequently Asked Questions about security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a comprehensive security scan on my codebase before release?▼

To run a comprehensive security scan before release, use the full scan profile to automatically execute 17 SAST, secrets detection, dependency audit, and infrastructure-as-code tools in a single command, generating a Markdown report of all critical and high-severity findings.

Can I gate my CI/CD pipeline to fail on high-severity code vulnerabilities?▼

Yes, you can gate your CI/CD pipeline by running a multi-engine security scan that automatically fails builds based on severity-based exit codes, preventing code vulnerabilities and leaked secrets from progressing through your workflows.

What is the best way to audit a Terraform project for security misconfigurations?▼

The best way to audit a Terraform project is to run an infrastructure-as-code security scan using engines like Checkov, which detects cloud misconfigurations alongside Python code vulnerabilities and dependency risks in a unified report.

Does this multi-engine security scanning approach support secrets detection in git history?▼

Yes, this multi-engine security scanning approach integrates Gitleaks to perform secrets detection across your git repository history, ensuring that accidentally committed credentials and tokens are caught during pre-release validation.

How do I scan only for dependency risks and leaked secrets during fast development cycles?▼

To scan only for dependency risks and leaked secrets during fast development cycles, select the configurable fast, secrets-only, or deps-only scan profiles to get rapid developer feedback without running the full suite of SAST engines.

When should I avoid running the full suite of 17 SAST engines?▼

You should avoid running the full suite of 17 SAST engines during active development when rapid feedback is required, opting instead for the fast scan profile to limit execution time while still catching critical vulnerabilities and leaked secrets.

Related Skills

Explore More Software Engineering Skills→
fatihkanfatihkan
7

sc-iac

Detect security misconfigurations in Infrastructure-as-Code files across Dockerfiles, Kubernetes, Terraform, and CI workflows.

Community
Advanced
cegit27cegit27
3

cso

Audit infrastructure security across secrets, dependencies, CI/CD, and LLM/AI.

Official
Advanced
JosiahSiegelJosiahSiegel
51

defender-for-devops

Integrate Microsoft Defender for DevOps into Azure Pipelines for automated security scanning.

Community
Advanced
LeandroBenjaminLLeandroBenjaminL

security-auditor

Automate security audits with static and dynamic analysis tools.

Community
Advanced