skills.rest
mscipio
mscipioCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-scanner

Scans codebases for vulnerabilities, secrets, and unsafe patterns via static analysis.

Updated Feb 17, 2026
Search Tags:#security#vulnerability#audit#compliance#secrets#code scan
One-click install
npx skills add https://github.com/mscipio/bilt-transactions-export --skill security-scanner-mscipio
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-scanner
Source: https://github.com/mscipio/bilt-transactions-export/tree/main/.opencode/skills/security-scanner
Command: npx skills add https://github.com/mscipio/bilt-transactions-export --skill security-scanner-mscipio

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill automates the detection of security vulnerabilities, hardcoded secrets, and unsafe coding patterns, preventing security issues from reaching production.

Core Features & Use Cases

  • Secret Detection: Identifies API keys, passwords, and private keys embedded in code.
  • Vulnerability Scanning: Finds common risks like SQL injection, XSS, and command injection.
  • Dependency Audit: Flags outdated or vulnerable third-party packages.
  • Use Case: Before merging a new feature, run this scanner to automatically catch any accidentally exposed API keys or potential SQL injection flaws, ensuring a more secure codebase.

Quick Start

Run the security-scanner skill to scan the current project for critical and high severity vulnerabilities.

Frequently Asked Questions about security-scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan my codebase for hardcoded secrets and API keys?▼

Scanning for hardcoded secrets identifies embedded API keys, passwords, and private keys using static analysis. The scanner applies pattern matching to detect exposed credentials across various languages and frameworks before they reach production.

Can I automate vulnerability scanning in a CI/CD pipeline?▼

Automated vulnerability scanning integrates directly into CI/CD pipelines and pre-commit hooks. It performs static analysis to find common risks like SQL injection, XSS, and command injection during software development workflows.

What is static analysis for detecting unsafe coding patterns?▼

Static analysis for unsafe patterns uses AST analysis and pattern matching to identify security vulnerabilities in source code. It detects risks like SQL injection and command injection without executing the application.

Does the security scanner flag outdated or vulnerable third-party packages?▼

Dependency auditing flags outdated or vulnerable third-party packages. The scanner evaluates your project dependencies to identify known security risks and ensure compliance within your codebase.

What is the best way to prevent security issues from reaching production?▼

Preventing security issues requires running automated security auditing before merging new features. Scanning codebases for vulnerabilities, hardcoded secrets, and unsafe patterns catches risks early in the development cycle.

How do I audit code for SQL injection and XSS vulnerabilities?▼

Auditing code for SQL injection and XSS uses static analysis to evaluate source code patterns. The scanner identifies these common injection risks alongside hardcoded secrets to secure your codebase.

Related Skills

Explore More Software Engineering Skills→
xdgxdg
20

code-review

Analyze code quality, security, performance, and maintainability in repositories.

Community
Intermediate
oimiragieooimiragieo
36

rule-auditor

Audit code against a rule index and report compliance violations.

Community
Basic
chrismcmackenchrismcmacken

create-semgrep-rule

Create custom Semgrep rules with metadata and tests for vulnerability detection.

Community
Advanced
DragonJARDragonJAR
330

Android-Pentesting-Skill

Analyze Android APKs for security vulnerabilities and generate bypass scripts.

Community
Advanced