skills.rest
sovrium
sovriumOFFICIAL
Explore all skills by this author →
WebsiteGitHub

security-scanner

Identify security vulnerabilities in codebases via static analysis.

3|Updated Mar 15, 2026
Search Tags:#OWASP#security#dependencies#secrets#vulnerabilities#scan
One-click install
npx skills add https://github.com/sovrium/sovrium --skill security-scanner-sovrium
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-scanner
Source: https://github.com/sovrium/sovrium/tree/main/.claude/skills/scanning-security
Command: npx skills add https://github.com/sovrium/sovrium --skill security-scanner-sovrium

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill scans codebase for common security vulnerabilities including input validation gaps, authentication bypasses, data exposure risks, SQL injection, XSS, CSRF, insecure dependencies, and secrets in code. Identifies security patterns without executing code. Use when user requests "security scan", "check vulnerabilities", "audit security", or mentions security review.

Core Features & Use Cases

  • Vulnerability pattern detection: Scans code for OWASP Top 10 patterns without executing code.
  • Input validation checks: Flags weak or missing sanitization in data flows.
  • Auth & access control gaps: Highlights routes or logic that may bypass authentication or authorization.
  • Secrets detection: Detects hardcoded credentials and exposed keys.
  • Dependency risk review: Checks dependencies for known CVEs and insecure configurations.

Quick Start

Run the security scan across your repository to produce a deterministic report you can review.

Frequently Asked Questions about security-scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan my codebase for security vulnerabilities without running code?▼

Security scanning identifies vulnerabilities through static analysis of your codebase, detecting OWASP Top 10 patterns, input validation gaps, authentication weaknesses, hardcoded secrets, and insecure dependencies without executing or modifying code. Run a scan across your repository to produce a deterministic report for review.

What security issues can a static analysis scan detect?▼

Static security analysis detects input validation gaps, authentication and authorization bypasses, data exposure risks, SQL injection, XSS, CSRF vulnerabilities, hardcoded credentials, exposed API keys, insecure dependency configurations, and CVEs in your dependencies.

Can I detect hardcoded secrets and credentials in my code?▼

Yes, secrets detection identifies hardcoded credentials, API keys, and exposed sensitive information embedded in your codebase without requiring code execution or modification.

How do I check my dependencies for known vulnerabilities?▼

Dependency risk review scans your project dependencies for known CVEs and insecure configurations, flagging vulnerable versions and security-relevant misconfigurations without modifying your code.

Does static code analysis cover authentication and access control issues?▼

Yes, the scan highlights routes and logic that may bypass authentication or authorization, identifying potential access control gaps in your application architecture.

Related Skills

Explore More Software Engineering Skills→
BasharAmsoBasharAmso
1

Security Audit

Audit code and dependencies for security vulnerabilities and generate a severity-rated report.

Community
Advanced
farmountainfarmountain
1

Vulnerability Scanner Agent

Scan code, dependencies, containers, and infrastructure for vulnerabilities across the SDLC.

Community
Advanced
jtucker9jtucker9

secrets-scanner

Detect hardcoded secrets in codebases and Git history.

Community
Advanced
elizaOSelizaOS
19.0k

static-analysis

Run CodeQL and Semgrep scans and parse SARIF results.

Official
Advanced