skills.rest
dhofheinz
dhofheinzCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

Security Scan Skill

Detect exposed secrets and insecure patterns in code repositories.

9|2|Updated Oct 13, 2025
Search Tags:#static analysis#vulnerability#compliance#security scan#code audit#url validation#file permissions#secret detection
One-click install
npx skills add https://github.com/dhofheinz/open-plugins --skill security-scan-skill
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Security Scan Skill
Source: https://github.com/dhofheinz/open-plugins/tree/main/plugins/marketplace-validator-plugin/commands/security-scan
Command: npx skills add https://github.com/dhofheinz/open-plugins --skill security-scan-skill

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Manually identifying security vulnerabilities, exposed secrets, and incorrect file permissions in plugins is a complex and critical task. This skill automates comprehensive security scans, including secret detection, file analysis, and URL validation, to ensure plugins are secure and compliant, reducing your risk of breaches.

Core Features & Use Cases

  • Secret Scanning: Detects hardcoded secrets, API keys, and sensitive information that could lead to security breaches.
  • File & Permission Analysis: Checks for insecure file configurations and permissions, preventing unauthorized access.
  • URL Validation: Verifies the safety and validity of external URLs, protecting users from malicious links.
  • Full Security Audit: Performs a comprehensive security assessment of the plugin codebase, covering multiple vulnerability types.
  • Use Case: Before publishing a plugin, a security auditor uses this skill to run a full security audit. This includes scanning for any accidentally committed credentials, checking that sensitive files have correct permissions, and validating all external links to prevent phishing or malware.

Quick Start

Use the security-scan skill to scan for secrets in the plugin directory "plugins/my-secure-plugin".

Frequently Asked Questions about Security Scan Skill

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect exposed secrets and API keys in my code repository?▼

Secret scanning detects hardcoded credentials, API keys, and sensitive information in your codebase. This skill automatically identifies accidentally committed secrets across your project tree to prevent data leakage and unauthorized access.

Can I scan for insecure file permissions and dangerous files in my plugin?▼

Yes, file and permission analysis checks for insecure configurations and dangerous files that could allow unauthorized access. The skill identifies permission misconfigurations that violate security best practices across your plugin directory.

What does a full security audit cover in code scanning?▼

A full security audit performs comprehensive assessment covering multiple vulnerability types: secret detection, file permission analysis, URL validation, and dangerous file identification. It provides contextual risk assessment and remediation guidance for all findings.

How do I validate external URLs to prevent phishing and malware risks?▼

URL validation verifies the safety and validity of external links in your codebase. This protects users from malicious URLs by checking URLs for known threats and invalid configurations before publishing.

When should I run a security scan before publishing a plugin?▼

Run a security scan before publication to verify no credentials were accidentally committed, file permissions are correct, and all external links are safe. Comprehensive scanning prevents breaches and compliance violations at release time.

Does this skill work with multi-scan workflows across different vulnerability types?▼

Yes, the skill supports multi-scan workflows including secrets, URLs, dangerous files, permissions, and full audits. It routes to specialized sub-commands based on arguments to handle complex security checks in a single workflow.

Related Skills

Explore More Software Engineering Skills→
Razaib-khanRazaib-khan

researching-with-deepwiki

Analyze public GitHub, GitLab, and Bitbucket repositories to explain architecture and implementation.

Community
Intermediate
jpoleyjpoley
50

security-reporter

Consolidates vulnerability findings into audit reports with risk assessment and compliance mapping.

Community
Advanced
kivo360kivo360
1

moai-alfred-proactive-suggestions

Generates proactive workflow suggestions based on risk patterns and optimization types.

Community
Advanced
HomericIntelligenceHomericIntelligence
18

scan-vulnerabilities

Scan code and dependencies for security vulnerabilities using Bandit, Safety, and Semgrep.

Official
Intermediate