security-scanner

Scanning code for secrets and vulnerabilities detects hardcoded API keys, passwords, SQL injection, XSS, and insecure dependencies. This Skill applies phase-based checks across secret detection, injection risks, and OWASP Top 10 controls, producing structured scan outputs with remediation guidance.

Yes. Dependency audit checks for insecure packages using tools like npm audit and pip-audit, identifying known vulnerabilities before deployment and reducing exposure to compromised libraries.

Code scanning detects hardcoded secrets, SQL injection, command injection, XSS attack vectors, CORS misconfigurations, CSP policy gaps, and weak cryptographic implementations across source code during development and CI pipelines.

Security scanning integrates into CI pipelines using Bash workflows and file globbing to automatically locate secrets, injection risks, and dependency vulnerabilities during build stages, producing structured outputs for gates and notifications.

Automated scanning identifies hardcoded secrets and common OWASP Top 10 vulnerabilities at scale without specialist expertise, covering injection vectors and dependency flaws faster than manual review while reducing human oversight gaps.

Scanning uses language-agnostic techniques—Grep pattern matching, file globbing, and dependency checkers—to detect secrets and misconfigurations across mixed-language codebases, making it suitable for polyglot environments.