vulnerability-scanner

Scanning dependencies for security vulnerabilities involves parsing lock files from ecosystems like npm, yarn, or pip to identify risky packages. This skill automates that audit process to produce structured findings with severity levels for CI pipelines and release audits.

Detecting hardcoded secrets and API keys requires scanning code patterns for cloud credentials, tokens, and passwords. This skill automates secrets detection alongside dependency analysis to generate a structured JSON security report.

Yes, automated vulnerability discovery supports multiple ecosystems and environments. It enforces explicit parsing of manifests, static code checks, and configuration validation to catch insecure defaults and risky code patterns.

Validating configurations to catch insecure defaults requires checking for common misconfigurations and risky file operations like insecure deserialization or eval usage. This skill automates these static code checks to prioritize security risks before merges.

Yes, dependency analysis works with npm audit and pip lock-file checks alongside yarn manifest parsing. It explicitly parses these files to identify and prioritize security vulnerabilities in your project dependencies.