skills.rest
damianpapadopoulos
damianpapadopoulosCOMMUNITY
Explore all skills by this author →
GitHub

security-scanner

Scan code changes for security vulnerabilities using static and dynamic analysis tools.

6|Updated Feb 13, 2026
Search Tags:#code review#STRIDE#security scanning#DAST#vulnerability detection#SAST
One-click install
npx skills add https://github.com/damianpapadopoulos/auto-claude-skills --skill security-scanner-damianpapadopoulos
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-scanner
Source: https://github.com/damianpapadopoulos/auto-claude-skills/tree/main/skills/security-scanner
Command: npx skills add https://github.com/damianpapadopoulos/auto-claude-skills --skill security-scanner-damianpapadopoulos

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires opengrep, semgrep, trivy, gitleaks, osv-scanner, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the detection of security issues in code changes, providing a streamlined process for identifying vulnerabilities during the review phase.

Core Features & Use Cases

  • STRIDE Threat Modeling: A pre-scan using STRIDE methodology to prioritize the risk of specific issues.
  • SAST and DAST Scanning: Runs SAST (static application security testing) with opengrep or semgrep and DAST (dynamic application security testing) with trivy and gitleaks.
  • Dependency Provenance: Reviews new dependencies for potential security risks like slopsquatting and hallucinated packages.
  • Secret Detection: Identifies hardcoded secrets in the codebase using gitleaks.
  • Triage and Fix: Provides a structured report of findings, allowing for easy identification and resolution of security issues.
  • Use Case: Integrate this Skill into your code review workflow to ensure security best practices are followed throughout the development process.

Quick Start

To scan for security issues in the current code branch, use the security-scanner skill.

Frequently Asked Questions about security-scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate vulnerability detection during code reviews?▼

Automate vulnerability detection by running static and dynamic analysis against code changes to identify injection attacks, broken authentication, and data exposure. This scanning process integrates directly into your review workflow to report findings.

Can I use STRIDE threat modeling alongside SAST and DAST scanning?▼

Yes, you can use STRIDE threat modeling as a pre-scan to prioritize specific risks before executing SAST and DAST scanning. This approach structures the evaluation of spoofing, tampering, and repudiation threats alongside automated tool results.

How do I detect hardcoded secrets and vulnerable dependencies in my codebase?▼

Detect hardcoded secrets and vulnerable dependencies by running secret detection and dependency provenance checks. This process identifies exposed credentials and flags hallucinated packages or slopsquatting risks in newly added project dependencies.

Do I need to install external tools like trivy and gitleaks to scan for security issues?▼

Yes, you need external tools like opengrep, semgrep, trivy, gitleaks, and osv-scanner installed to perform comprehensive security scanning. These dependencies provide the static and dynamic analysis engines required to generate triage reports.

What is the best way to triage security findings from static and dynamic code analysis?▼

The best way to triage security findings is to aggregate results from SAST and DAST tools into a structured report. This allows for easy identification and resolution of vulnerabilities by prioritizing issues based on the STRIDE methodology.

Does this security scanning approach check for slopsquatting in new dependencies?▼

Yes, this security scanning approach checks for slopsquatting and hallucinated packages through dependency provenance reviews. It evaluates newly added dependencies to identify potential security risks before they are integrated into the codebase.

Related Skills

Explore More Software Engineering Skills→
xtrm-devxtrm-dev
4

security-pipeline

Bootstrap a GitHub security pipeline with secret scanning, SAST, and dependency checks.

Official
Advanced
pascallammerspascallammers
1

security-audit-checklist

Generate an OWASP Top 10 security audit checklist for web applications.

Community
Intermediate
jeremylongshorejeremylongshore
2.6k

building-cicd-pipelines

Generate CI/CD pipeline configurations for GitHub Actions, GitLab CI, and Jenkins.

Community
Intermediate
devendrapratapsinghdevendrapratapsingh
1

security

Scan code, containers, and infrastructure for security vulnerabilities.

Community
Advanced