vulnerability-scanner

Scan codebases for dependencies, secrets, and dangerous patterns.

4|Updated Feb 8, 2026

Search Tags:#security #vulnerability #owasp #dependency audit #secrets detection #code scan

Ready to run

npx skills add https://github.com/alexgutscher26/ClawTrace --skill vulnerability-scanner-alexgutscher26

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: vulnerability-scanner
Source: https://github.com/alexgutscher26/ClawTrace/tree/main/.agent/skills/vulnerability-scanner
Command: npx skills add https://github.com/alexgutscher26/ClawTrace --skill vulnerability-scanner-alexgutscher26

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps identify and prioritize security vulnerabilities within a codebase, ensuring robust supply chain security, preventing hardcoded secrets, and flagging dangerous code patterns.

Core Features & Use Cases

Dependency Analysis: Audits project dependencies for known vulnerabilities (OWASP A03).
Secret Detection: Scans code and configuration files for hardcoded API keys, passwords, and credentials (OWASP A04).
Code Pattern Scanning: Identifies risky code constructs like injection vulnerabilities, unsafe deserialization, and insecure configurations (OWASP A05, A02).
Use Case: Before deploying a new feature, run this Skill to automatically scan the codebase for critical vulnerabilities, ensuring compliance with security best practices and reducing the risk of breaches.

Quick Start

Run a full security scan on the current project directory.

Frequently Asked Questions about vulnerability-scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan my codebase for hardcoded secrets and API keys?▼

To scan a codebase for hardcoded secrets, this skill automatically analyzes code and configuration files to detect embedded API keys, passwords, and credentials, addressing OWASP A04 vulnerabilities and providing detailed risk findings.

How do I audit project dependencies for known vulnerabilities?▼

Auditing project dependencies for known vulnerabilities is performed by this skill through automated dependency analysis, targeting supply chain security risks and identifying outdated or compromised packages based on OWASP A03 principles.

Can I detect insecure code patterns like injection risks and unsafe deserialization?▼

Yes, this skill can detect insecure code patterns by scanning for risky constructs including injection vulnerabilities, unsafe deserialization, and insecure configurations, mapping these findings to OWASP Top 10 cryptographic failure and misconfiguration categories.

What is the best way to check for security misconfigurations before deployment?▼

The best way to check for security misconfigurations before deployment is running an automated code scan, which identifies insecure configurations and dangerous code patterns while providing an overall risk assessment to ensure compliance with security best practices.

Does the vulnerability scanner require any external security tools or dependencies to run?▼

No external security tools or dependencies are required to run the vulnerability scanner, as it utilizes self-contained Python scripts to perform dependency audits, secret detection, and code pattern scanning directly within the project directory.

How does automated code scanning prioritize identified security vulnerabilities?▼

Automated code scanning prioritizes security vulnerabilities by evaluating dependency flaws, hardcoded secrets, and dangerous code patterns, generating detailed findings mapped to OWASP Top 10 principles to provide an overall risk assessment for the codebase.