skills.rest
rafaelminatto1
rafaelminatto1COMMUNITY
Explore all skills by this author →
GitHub

vulnerability-scanner

Scan software projects for security vulnerabilities and generate JSON findings.

Updated Sep 2, 2025
Search Tags:#security#vulnerability#dependencies#secrets#scanning#code-patterns#risk-analysis
One-click install
npx skills add https://github.com/rafaelminatto1/fisioflow-51658291 --skill vulnerability-scanner-rafaelminatto1
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vulnerability-scanner
Source: https://github.com/rafaelminatto1/fisioflow-51658291/tree/main/.agent/skills/vulnerability-scanner
Command: npx skills add https://github.com/rafaelminatto1/fisioflow-51658291 --skill vulnerability-scanner-rafaelminatto1

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Automates the identification and prioritization of security vulnerabilities in software projects by applying OWASP 2025 guidance, with a focus on dependencies, secrets, code patterns, and configurations.

Core Features & Use Cases

  • Threat-informed vulnerability analysis across dependencies, code, and configurations.
  • Supply chain security checks, including dependency integrity and build-process risk.
  • Threat modeling and attack-surface mapping to prioritize remediation in real-world projects.

Quick Start

Run the vulnerability-scanner against your project to generate a JSON report of security findings.

Frequently Asked Questions about vulnerability-scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan my project for security vulnerabilities in dependencies and code?▼

To scan for security vulnerabilities, run the scanner against your project directory to check dependencies, secrets, dangerous code patterns, and configurations, producing a structured JSON report of findings.

Can I detect leaked secrets and dangerous code patterns in my CI/CD pipeline?▼

Yes, you can detect leaked secrets and dangerous code patterns by integrating the deterministic Python-based scanning suite into your CI/CD pipeline to analyze code repositories and generate structured JSON findings.

Does the vulnerability scanner support npm, pip, and other package managers?▼

The vulnerability scanner supports dependency integrity checks for npm, yarn, pnpm, and pip package managers, applying supply chain security analysis to identify risks in your software project.

What is the best way to prioritize security remediation using threat modeling?▼

The best way to prioritize security remediation is using threat-informed vulnerability analysis that maps the attack surface and applies OWASP 2025 guidance to evaluate real-world project risk.

Do I need Python installed to run the vulnerability scanning scripts?▼

Yes, you need Python installed because the vulnerability scanner implements deterministic scanning using a Python-based suite of scripts to evaluate dependencies, secrets, and configurations.

Are there limitations when scanning configuration issues in large code repositories?▼

A limitation is that the scanner produces structured JSON findings focused on deterministic checks for dependencies, secrets, code patterns, and configurations, which may require manual review for complex contextual threats.

Related Skills

Explore More Software Engineering Skills→
sjinkssjinks

security-review-owasp-django-rest-framework

Review Django REST Framework applications for OWASP security weaknesses.

Community
Advanced
DonTiziDonTizi
2

security-audit

Scan codebases for secrets, OWASP risks, and vulnerable dependencies.

Community
Advanced
achmfachmf

vulnerability-scanner

Scan software projects for vulnerabilities, hardcoded secrets, and insecure code patterns.

Community
Advanced
johngutierrez31johngutierrez31

cybersecurity-analyst

Analyze security events using threat modeling and zero-trust frameworks.

Community
Advanced