Audit GitHub repositories with Semgrep, TruffleHog, and osv-scanner for vulnerabilities.
npx skills add https://github.com/anajuliabit/aeon --skill vuln-scanner-anajuliabit
Please help me install this Agent Skill. Skill: Vuln Scanner Source: https://github.com/anajuliabit/aeon/tree/main/skills/vuln-scanner Command: npx skills add https://github.com/anajuliabit/aeon --skill vuln-scanner-anajuliabit
This Skill audits trending GitHub repositories to identify real, potentially exploitable security issues without turning findings into reckless public disclosures.
Run the Vuln Scanner skill with a target repository as the variable var set to owner/repo to produce an evidence-based triage and route confirmed findings to PVR or dependency-bump PRs.
High-intent search queries and answers about installing and using this skill.
Vulnerability scanning for GitHub repositories is handled by running Semgrep, TruffleHog, and osv-scanner to detect code flaws, leaked credentials, and dependency CVEs. The process includes evidence-first triage, deduplication across runs, and safe disclosure routing via GitHub PVR or dependency PRs.
Disclosing security vulnerabilities safely involves routing findings through GitHub Private Vulnerability Reporting (PVR) or a documented private contact. Dependency CVEs are disclosed via public PR bumps, while unpatched code issues are routed privately to avoid reckless public exposure.
Yes, you can scan smart contracts for vulnerabilities using Slither for Solidity analysis, alongside Semgrep for SAST. The scanning applies evidence-first triage to confirm reachability and exploitability before treating any hit as a verified vulnerability.
Reduce false positives in secrets detection and SAST scans by using verified tools like TruffleHog and applying evidence-first triage. The scanner reads surrounding code context and confirms call-path reachability and severity before treating a hit as a real vulnerability.
Yes, GitHub vulnerability scanning supports automated dependency CVE remediation by identifying vulnerable packages with osv-scanner and routing disclosures via public dependency-bump PRs. This ensures dependency issues are addressed directly through repository contributions.
Limitations of autonomous security monitoring include skipping rescans of the same repository within 30 days to avoid duplicates. If no safe disclosure channel like PVR or private contact exists, findings are skipped entirely to prevent harmful public exposure.
Atrium-HermesIdentify real security vulnerabilities in trending repositories and route disclosures.
swarm-ai-researchMonitor private vulnerability reports and track their GitHub advisory lifecycle states.
cdalsoniiiTriage gosec, golangci-lint, and govulncheck findings by severity and false positives.
seb1nRun SAST scans with Semgrep and CodeQL to detect vulnerabilities in source code.
