vulnerability-scanner

Detect security vulnerabilities in code, running apps, and dependencies.

10|2|Updated Mar 10, 2026

Search Tags:#security #vulnerability #compliance #sast #cve #sca #dast

Ready to run

npx skills add https://github.com/bugrabilge/bilge-development-kit --skill vulnerability-scanner-bugrabilge

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: vulnerability-scanner
Source: https://github.com/bugrabilge/bilge-development-kit/tree/main/skills/vulnerability-scanner
Command: npx skills add https://github.com/bugrabilge/bilge-development-kit --skill vulnerability-scanner-bugrabilge

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill addresses the critical need to identify and mitigate security risks within software by scanning code, auditing dependencies, and tracking vulnerabilities.

Core Features & Use Cases

SAST/DAST: Analyzes source code (SAST) and running applications (DAST) for security flaws.
SCA: Audits project dependencies for known vulnerabilities (CVEs) and license issues.
Remediation Guidance: Provides strategies and steps to fix identified security problems.
Use Case: Before deploying a new feature, use this Skill to perform a full security scan, ensuring no critical vulnerabilities are introduced and all dependencies are up-to-date and secure.

Quick Start

Scan the current project's codebase for security vulnerabilities using Semgrep and audit its npm dependencies.

Frequently Asked Questions about vulnerability-scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan my codebase for security vulnerabilities and audit npm dependencies?▼

To scan for security vulnerabilities, this Skill uses Semgrep for SAST analysis and runs npm audit to check dependencies for known CVEs, providing remediation guidance to fix identified flaws.

What is the difference between SAST, DAST, and SCA vulnerability scanning?▼

SAST analyzes source code for flaws, DAST tests running applications dynamically, and SCA audits dependencies for known vulnerabilities. This Skill performs all three to provide comprehensive security coverage.

Can I map security scan findings to compliance standards like PCI DSS and SOC 2?▼

Yes, vulnerability scan findings can be mapped directly to compliance standards like PCI DSS and SOC 2. This Skill correlates identified security flaws and dependency CVEs to specific regulatory requirements.

Does this vulnerability scanner work with OWASP ZAP and Trivy for DAST and SCA?▼

Yes, this vulnerability scanner supports OWASP ZAP for Dynamic Application Security Testing and Trivy for Software Composition Analysis, alongside Semgrep and npm audit to identify security flaws.

What is the best way to get remediation guidance for known CVEs in project dependencies?▼

The best way to get remediation guidance is running an SCA scan. This Skill audits dependencies for known vulnerabilities and automatically provides actionable strategies and steps to resolve the identified security problems.

When do I need to run a full security vulnerability scan before deployment?▼

You need a full security vulnerability scan before deploying new features to ensure no critical flaws are introduced. This Skill performs SAST, DAST, and SCA to verify code and dependencies are secure.