skills.rest
YukiIto1999
YukiIto1999COMMUNITY
Explore all skills by this author →
GitHub

source-code-scanning

Scan source code with Semgrep, CodeQL, and Bandit to detect vulnerabilities and secrets.

Updated Apr 23, 2026
Search Tags:#vulnerability#sast#secrets-detection#security-review#dependency-check#source-code
One-click install
npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill source-code-scanning
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: source-code-scanning
Source: https://github.com/YukiIto1999/ctf-sleuth/tree/main/.claude/skills/source-code-scanning
Command: npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill source-code-scanning

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill reduces manual effort by automatically performing security analysis across codebases, surfacing vulnerabilities, insecure patterns, and hardcoded secrets for faster remediation.

Core Features & Use Cases

  • Automated multi-language SAST across Python, JavaScript, Java, Go, and more with language-aware checks.
  • Dependency CVE scanning and secrets detection to harden third-party components.
  • Guidance for remediation and prioritized backlog items, including OWASP Top 10 alignment.
  • Use Case: A development team runs periodic codebase reviews to catch critical issues before release.

Quick Start

Provide your codebase repository or path to trigger an automated security review.

Frequently Asked Questions about source-code-scanning

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate SAST across multiple programming languages in my repository?▼

Automate SAST by enumerating repository assets to tailor language-aware workflows, applying tools like Semgrep, CodeQL, and Bandit across Python, JavaScript, Java, and Go to detect insecure patterns and hardcoded secrets.

What is the best way to scan dependencies for CVEs and hard-coded secrets?▼

Dependency CVE scanning and secrets detection harden third-party components by applying automated scanners to libraries and build systems, identifying vulnerabilities and hardcoded credentials across the codebase.

How does source code scanning align remediation steps with OWASP Top 10?▼

Source code scanning aligns remediation with OWASP Top 10 by returning a structured plan of actionable steps and CWE guidance, prioritizing vulnerabilities and recommending version pins and patches for insecure patterns.

Can I use automated security review for periodic codebase checks before release?▼

Automated security review supports periodic codebase checks by surfacing vulnerabilities and insecure patterns before release, providing development teams with prioritized backlog items for faster remediation.

Does source code scanning work with build systems and third-party libraries?▼

Source code scanning works with build systems and third-party libraries by applying dependency CVE scanners and language-aware SAST tools to detect vulnerabilities and insecure patterns across various languages and frameworks.

Related Skills

Explore More Software Engineering Skills→
LeoWSY-hashblueLeoWSY-hashblue
3

source-code-scanning

Scan source code for vulnerabilities, secrets, and dependency CVEs.

Community
Advanced
whilpwhilp

bump

Check for new dependency releases and update version pins in a repository.

Community
Intermediate
outfitter-devoutfitter-dev
28

security-engineering

Audit codebases for security vulnerabilities and misconfigurations using OWASP and CWE mappings.

Official
Advanced
ACuberoACubero

security-audit

Detect security vulnerabilities and exposed secrets in software projects.

Community
Advanced