security-scanner

Scan codebases for security vulnerabilities and generate a release checklist.

54|21|Updated Feb 12, 2026

Search Tags:#code review #checklist #security #compliance #sast #vulnerability scanning

Ready to run

npx skills add https://github.com/Nhqvu2005/VibeGravityKit --skill security-scanner-nhqvu2005

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-scanner
Source: https://github.com/Nhqvu2005/VibeGravityKit/tree/main/VibeGravityKit/.agent/skills/security-scanner
Command: npx skills add https://github.com/Nhqvu2005/VibeGravityKit --skill security-scanner-nhqvu2005

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and data (resource) components.

What problem does it solve?

This Skill helps developers quickly identify potential security vulnerabilities in their codebase and ensures a standardized security review process before releases.

Core Features & Use Cases

Vulnerability Scanning: Detects hardcoded secrets, SQL injection risks, XSS vulnerabilities, and insecure dependencies using regular expressions.
Security Checklist Generation: Creates a comprehensive checklist covering authentication, data protection, OWASP Top 10, and more, ensuring all critical security aspects are reviewed.
Use Case: Before merging a new feature, run the security scanner to catch any accidentally committed API keys and then generate the security checklist to ensure all security best practices are followed.

Quick Start

Run the security scanner script against the current directory.

Frequently Asked Questions about security-scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan my codebase for hardcoded secrets and security vulnerabilities?▼

To scan your codebase for hardcoded secrets and vulnerabilities, you can run a static application security testing (SAST) scanner against your current directory to detect risks like injection flaws and XSS.

Can I generate a security release checklist that covers OWASP Top 10 compliance?▼

Yes, you can generate a standardized security release checklist that covers OWASP Top 10 compliance, ensuring critical security aspects like authentication and data protection are reviewed before release.

Does regex-based SAST work for detecting insecure dependencies and XSS risks?▼

Regex-based SAST effectively detects insecure dependencies and XSS risks by matching known vulnerable patterns in the code, though it focuses on common flaws rather than deep execution paths.

What is the best way to automate pre-release security audits for my codebase?▼

The best way to automate pre-release security audits is to run a vulnerability scanner script that identifies hardcoded secrets and generates a standardized security checklist before merging new features.

What are the limitations of using regular expressions for vulnerability scanning in SAST?▼

Using regular expressions for vulnerability scanning limits detection to predefined patterns, meaning it might miss complex injection flaws or logical vulnerabilities not matching standard regex templates.