skills.rest
achmf
achmfCOMMUNITY
Explore all skills by this author →
GitHub

vulnerability-scanner

Scan software projects for vulnerabilities, hardcoded secrets, and insecure code patterns.

Updated Jun 4, 2026
Search Tags:#security#vulnerability#owasp#audit#compliance#threat-modeling
One-click install
npx skills add https://github.com/achmf/KostaHub --skill vulnerability-scanner-achmf
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vulnerability-scanner
Source: https://github.com/achmf/KostaHub/tree/main/.agent/skills/vulnerability-scanner
Command: npx skills add https://github.com/achmf/KostaHub --skill vulnerability-scanner-achmf

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill addresses the challenge of identifying security vulnerabilities and misconfigurations in software projects by applying industry-standard principles like OWASP 2025 and automated code pattern analysis.

Core Features & Use Cases

  • Automated Security Audits: Scans project files for hardcoded secrets, dangerous code patterns, and insecure configurations.
  • Supply Chain Integrity: Validates dependency security and ensures lock files are present to prevent supply chain attacks.
  • Use Case: Before deploying a new application, use this Skill to scan the codebase for exposed API keys, SQL injection risks, or outdated dependencies to ensure the project meets security compliance standards.

Quick Start

Run the vulnerability scanner on the current project directory to identify potential security risks and generate a detailed report.

Frequently Asked Questions about vulnerability-scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan my codebase for hardcoded secrets and insecure code patterns?▼

To scan for hardcoded secrets and insecure code patterns, run an automated security audit on your project directory. This performs static analysis and pattern matching to detect exposed credentials, injection risks, and misconfigurations, generating a detailed vulnerability report.

What security vulnerabilities can static analysis detect before deploying a new application?▼

Static analysis detects vulnerabilities like SQL injection, hardcoded API keys, insecure configurations, and dangerous code patterns. It targets development environments to identify risks and enforce compliance before deployment.

Does this vulnerability scanner enforce OWASP 2025 standards for CI/CD pipelines?▼

Yes, the vulnerability scanner enforces OWASP 2025 standards within CI/CD pipelines. It performs comprehensive security analysis to ensure software projects meet industry-standard compliance and supply chain integrity requirements.

Can I validate dependency security and lock files to prevent supply chain attacks?▼

Yes, you can validate dependency security and verify lock files are present. This supply chain integrity check prevents supply chain attacks by ensuring project dependencies are secure and properly locked.

What is the best way to perform threat modeling and identify misconfigurations in a software project?▼

The best way to perform threat modeling and identify misconfigurations is applying automated code pattern analysis. This proactive security analysis targets project files to detect risks and enforce compliance standards.

Related Skills

Explore More Software Engineering Skills→
DonTiziDonTizi
2

security-audit

Scan codebases for secrets, OWASP risks, and vulnerable dependencies.

Community
Advanced
iulianditaiuliandita
2

security-audit

Audit application codebases, configurations, and CI/CD pipelines for security vulnerabilities.

Community
Advanced
mostafasudomostafasudo
3

cso

Audit infrastructure security across secrets, dependencies, CI/CD, and AI systems.

Community
Advanced
mmsu-pawpatrolmmsu-pawpatrol
2

security-review

Analyze code repositories for injection, deserialization, and misconfiguration vulnerabilities.

Official
Advanced