security-scan

Scan JavaScript and TypeScript code for security vulnerabilities and missing middleware.

5|Updated Mar 8, 2026

Search Tags:#security #owasp #static-analysis #sql-injection #auth #secrets-detection #code-scan

Ready to run

npx skills add https://github.com/micahcourey/temporal-plane --skill security-scan-micahcourey

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-scan
Source: https://github.com/micahcourey/temporal-plane/tree/main/.ai/skills/security-scan
Command: npx skills add https://github.com/micahcourey/temporal-plane --skill security-scan-micahcourey

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the discovery of common security vulnerabilities in JavaScript and TypeScript codebases so reviewers and CI systems can find critical auth, injection, and secret-leak issues early.

Core Features & Use Cases

Pattern-based static scanning: Searches routes, queries, and error handling for missing authentication, missing permissions checks, string-concatenated queries, and exposed stack traces.
Secrets and configuration checks: Detects hardcoded credentials and risky logging patterns that may leak sensitive data.
Use Case: Integrate the scanner into a pre-merge CI job to block merges with critical or high severity findings and surface remediation recommendations to engineers.

Quick Start

Run the security scanner on the project's source directory to generate a prioritized security report.

Frequently Asked Questions about security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan JavaScript and TypeScript code for security vulnerabilities like SQL injection?▼

Run a static security scanner on the project's source directory to detect injection risks and missing auth in JavaScript and TypeScript. It searches for string-concatenated queries, hardcoded secrets, and exposed stack traces to produce prioritized JSON or human-readable reports.

What types of authentication and injection risks should I check for during a code review?▼

Check for missing authentication middleware, missing permission checks, and string-concatenated database queries. A static security scanner detects these injection and auth risks along with hardcoded secrets and risky logging patterns to secure API endpoints and route handlers.

Can I integrate a static code scan into CI validation to block merges with critical security findings?▼

Yes, integrate the security scanner into a pre-merge CI job to validate code. It blocks merges containing critical or high severity findings like hardcoded secrets and missing auth, surfacing remediation recommendations to engineers during CI validation.

Does this security scanner detect hardcoded secrets and risky logging patterns in API route handlers?▼

Yes, the scanner performs secrets and configuration checks to detect hardcoded credentials and risky logging patterns in API route handlers. It identifies sensitive data leaks and outputs JSON or human-readable reports with severity classification for fast remediation.

What is the best way to find missing permission middleware in JavaScript route handlers?▼

Use pattern-based static scanning on JavaScript route handlers and API endpoints to find missing permission middleware. The scanner identifies missing auth checks and produces a prioritized security report with severity classification for remediation.