skills.rest
gar-ai
gar-aiOFFICIAL
Explore all skills by this author →
GitHub

security-scan-local

Orchestrate Semgrep, Trivy, and Gitleaks scans to detect vulnerabilities and secrets locally.

1|Updated Dec 30, 2025
Search Tags:#devops#security#semgrep#trivy#gitleaks#code-security#local-scan
One-click install
npx skills add https://github.com/gar-ai/mallorn --skill security-scan-local
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-scan-local
Source: https://github.com/gar-ai/mallorn/tree/main/.claude/skills/security-scan-local
Command: npx skills add https://github.com/gar-ai/mallorn --skill security-scan-local

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Detect and prevent security issues by running trusted local scanners (Semgrep, Trivy, Gitleaks) before code is pushed.

Core Features & Use Cases

  • Orchestrates three industry-standard security tools (Semgrep, Trivy, Gitleaks) to provide CI-like checks locally.
  • Includes scripts to verify tool installation, run all scans, or target specific tools for faster feedback.
  • Works across common languages and project types to catch vulnerabilities, secrets, and code issues early.

Quick Start

Install the required tools and run the local security scans by executing python3 run.py.

Frequently Asked Questions about security-scan-local

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run local security scans before pushing code?▼

Run local security scans before pushing code by executing python3 run.py to orchestrate Semgrep, Trivy, and Gitleaks, detecting vulnerabilities and secrets across languages with consistent exit codes and summarized results.

What is the best way to detect leaked secrets in my local development workflow?▼

Detect leaked secrets in your local development workflow by running Gitleaks through the orchestrated Python script, which provides CI-like secret detection on your machine before code is pushed to the repository.

Do I need to install Semgrep, Trivy, and Gitleaks before running the scans?▼

Yes, you need to install Semgrep, Trivy, and Gitleaks, but the Python orchestration scripts include installation checks to verify tool availability and run targeted scans for faster security feedback.

Can I run Semgrep and Trivy across different project types and languages?▼

Yes, you can run Semgrep and Trivy across common languages and project types to catch vulnerabilities, code issues, and secrets early with CI-like security checks on your local machine.

How do I get faster security feedback by running a specific scanner locally?▼

Get faster security feedback by targeting a specific scanner locally through the Python scripts, which support running individual tools like Semgrep, Trivy, or Gitleaks instead of executing all scans together.

Why use local code security scans instead of waiting for CI pipeline checks?▼

Use local code security scans instead of waiting for CI pipeline checks to catch vulnerabilities and secrets before pushing, providing immediate developer feedback and preventing insecure code from reaching the remote repository.

Related Skills

Explore More Software Engineering Skills→
MakisuoMakisuo
1.6k

clickhousectl-local-dev

Install and configure a local ClickHouse environment with clickhousectl.

Community
Intermediate
kissrosecicd-hubkissrosecicd-hub
31

Git Secrets Pre-Commit Scanner

Scan Git diffs for exposed credentials using entropy analysis and regex patterns.

Community
Intermediate
claudcherejiclaudchereji

dx-optimizer

Analyze build times and HMR latency to implement performance optimizations.

Community
Advanced
JosiahSiegelJosiahSiegel
51

defender-for-devops

Integrate Microsoft Defender for DevOps into Azure Pipelines for automated security scanning.

Community
Advanced