security-scanning

Automate security scanning for JavaScript and Python projects.

1|Updated Dec 30, 2025

Search Tags:#security #dependencies #secrets #sast #vulnerabilities #scanning

Ready to run

npx skills add https://github.com/statick88/dotfiles --skill security-scanning-statick88

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-scanning
Source: https://github.com/statick88/dotfiles/tree/main/amp/.agents/skills/security-scanning
Command: npx skills add https://github.com/statick88/dotfiles --skill security-scanning-statick88

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the detection of vulnerabilities in code and dependencies, ensuring a more secure software development lifecycle.

Core Features & Use Cases

Dependency Scanning: Checks for known vulnerabilities in npm and Python packages.
Static Analysis (SAST): Identifies security flaws directly in the codebase using tools like Semgrep and Bandit.
Secret Detection: Scans for accidentally exposed API keys, passwords, and other secrets.
Use Case: Integrate this Skill into your CI/CD pipeline to automatically scan all code changes for security issues before deployment, preventing breaches and data leaks.

Quick Start

Run an automated security scan on the current project's dependencies and code.

Frequently Asked Questions about security-scanning

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate security scanning for dependencies and source code?▼

Automate security scanning by integrating automated tools into your pipeline to check npm and Python dependencies for known vulnerabilities. It also performs static analysis using Semgrep and Bandit to identify security flaws directly in your source code.

Can I detect accidentally exposed secrets like API keys in my codebase?▼

Yes, you can detect exposed secrets by running automated secret detection scans using Gitleaks and TruffleHog. This process identifies accidentally committed API keys, passwords, and other sensitive credentials within your codebase.

How do I add SAST and dependency audits to a CI/CD pipeline?▼

Add SAST and dependency audits to a CI/CD pipeline by configuring automated scans to run on code changes. This evaluates npm and Python packages for vulnerabilities and runs static analysis before deployment, preventing breaches and data leaks.

Does this security scanning support both JavaScript and Python projects?▼

Yes, security scanning supports both JavaScript and Python projects. It performs dependency audits specifically tailored for npm packages and Python environments, alongside general source code static analysis for both ecosystems.

What is the best way to prevent vulnerable dependencies in continuous integration?▼

The best way to prevent vulnerable dependencies in continuous integration is to automate vulnerability assessment scans on all code changes. This ensures that known security flaws in npm and Python packages are identified and blocked before deployment.

Can I use pre-commit hooks to run SAST and secret detection?▼

Yes, you can use pre-commit hooks to run SAST and secret detection. Implementing these hooks allows Semgrep, Bandit, Gitleaks, and TruffleHog to evaluate staged files locally, catching vulnerabilities and exposed secrets before code is committed.