skills.rest
LeoWSY-hashblue
LeoWSY-hashblueCOMMUNITY
Explore all skills by this author →
GitHub

source-code-scanning

Scan source code for vulnerabilities, secrets, and dependency CVEs.

3|1|Updated May 26, 2026
Search Tags:#security#dependencies#sast#code-review#secrets-detection#malicious-patterns
One-click install
npx skills add https://github.com/LeoWSY-hashblue/-communitytools-custom --skill source-code-scanning-leowsy-hashblue
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: source-code-scanning
Source: https://github.com/LeoWSY-hashblue/-communitytools-custom/tree/main/skills/source-code-scanning
Command: npx skills add https://github.com/LeoWSY-hashblue/-communitytools-custom --skill source-code-scanning-leowsy-hashblue

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security-focused source code review and SAST helps teams identify vulnerabilities, insecure patterns, hardcoded secrets, and dangerous dependencies before they ship.

Core Features & Use Cases

  • Automated SAST across languages and frameworks
  • Dependency CVE scanning and governance for third-party packages
  • Secrets detection and hardcoded credential discovery
  • Manual review of high-risk sinks and insecure patterns
  • Threat-informed reporting with CWE/CVE references for remediation

Quick Start

Configure your project to run a multi-tool SAST workflow against the repository to identify issues and generate a remediation plan.

Frequently Asked Questions about source-code-scanning

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run SAST and dependency CVE checks on a source code repository?▼

To perform SAST and dependency CVE checks, execute a multi-tool workflow against your repository to identify vulnerabilities, detect secrets, and produce a remediation plan.

What is the best way to scan source code for hardcoded secrets and malicious patterns?▼

Scanning for secrets and malicious patterns requires running automated detection alongside manual review of high-risk sinks to discover hardcoded credentials and dangerous code constructs.

Can I use automated code review across different programming languages and frameworks?▼

Yes, automated code review applies to code bases, repositories, or snippets across languages and frameworks, executing SAST and dependency checks to identify security flaws.

Does source code scanning provide references for fixing identified vulnerabilities?▼

Source code scanning provides threat-informed reporting with CWE and CVE references, enabling teams to understand and remediate vulnerabilities, insecure patterns, and dangerous dependencies.

Why do I need manual review if I already run automated SAST tools?▼

Manual review is needed alongside automated SAST tools to inspect high-risk sinks and insecure patterns that automated scanners might miss, ensuring thorough vulnerability remediation before shipping.

Related Skills

Explore More Software Engineering Skills→
Hypercart-Dev-ToolsHypercart-Dev-Tools
2

Architectural Baseline Diagnoser

Diagnose a repository's architectural style by analyzing dependency manifests, directory structures, and code patterns.

Official
Intermediate
thejefflarsonthejefflarson
20

cryptographic-failures

Detect and remediate cryptographic weaknesses in software code.

Community
Advanced
sandeshbagmaresandeshbagmare

gitlab-ci-patterns

Automate GitLab CI/CD pipeline configurations for multi-stage workflows, caching, and distributed runners.

Community
Advanced
iiammaeiiammae

shannon

Automates white-box security assessments for web applications and APIs.

Community
Advanced