skills.rest
Tgoldi
TgoldiCOMMUNITY
Explore all skills by this author →
GitHub

vulnerability-scanner

Scan projects for secrets, dangerous code patterns, dependency vulnerabilities, and misconfigurations.

1|Updated May 10, 2026
Search Tags:#code analysis#security#owasp#secret detection#dependency audit#vulnerability scanning#risk prioritization
One-click install
npx skills add https://github.com/Tgoldi/claude-skills --skill vulnerability-scanner-tgoldi
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vulnerability-scanner
Source: https://github.com/Tgoldi/claude-skills/tree/main/vulnerability-scanner
Command: npx skills add https://github.com/Tgoldi/claude-skills --skill vulnerability-scanner-tgoldi

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Security reviews often miss hardcoded credentials, injection-prone code patterns, vulnerable dependencies, and insecure configurations because manual audits are slow and inconsistent across large codebases. ## Core Features & Use Cases - Automated Security Scanning: Run a Python script that checks dependencies (npm audit, lock files), hardcoded secrets (AWS keys, JWTs, database strings), dangerous code patterns (eval, SQL concatenation, unsafe deserialization), and configuration issues (debug mode, CORS wildcards). - OWASP 2025 Guidance: Apply structured checklists covering the OWASP Top 10, authentication, API security, and data protection during audits. - Risk Prioritization: Score findings using CVSS, EPSS exploit likelihood, asset value, and exposure to decide what to fix first. - Use Case: Before deploying a Node.js API, run the scanner to detect a committed AWS access key and an npm dependency with a critical CVE, then use the checklists to verify security headers and session handling. ## Quick Start Ask the assistant to run a security scan on the current project and report any critical findings with remediation steps.

Frequently Asked Questions about vulnerability-scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan a project for hardcoded secrets and API keys?▼

Run python scripts/security_scan.py <project_path> --scan-type secrets to scan source and config files for patterns like AWS keys, JWTs, database connection strings, and private keys. Findings are reported with file paths and severity levels in JSON format.

How to check npm dependencies for known vulnerabilities?▼

Use the deps scan type, which verifies lock file presence and runs npm audit --json to count critical, high, moderate, and low severity vulnerabilities. Missing lock files are flagged as high severity supply chain risks.

What dangerous code patterns does the scanner detect?▼

The pattern scanner detects eval() and exec() usage, SQL string concatenation, dangerouslySetInnerHTML, subprocess with shell=True, pickle deserialization, disabled SSL verification, and unsafe YAML loading across common code file extensions.

Does the security scanner work with Python-only projects?▼

Yes, the scanner works on any directory containing supported file types including .py files. The npm audit step is skipped automatically when no package.json exists, while secrets, patterns, and config scans still run.

Why does the scan report no security headers configuration?▼

The config scanner looks for next.config.js, middleware.ts, or nginx.conf to verify security headers are configured. If none exist, it flags a medium severity finding recommending CSP, HSTS, and X-Frame-Options headers.

What are the limitations of regex-based secret scanning?▼

Regex patterns can produce false positives on placeholder values and miss obfuscated or split secrets. The scanner limits output to 15 findings per category and should be combined with manual review using the provided OWASP checklists.

Related Skills

Explore More Software Engineering Skills→
utkusenutkusen
1.3k

sast-analysis

Map codebase architecture and technology stack into sast/architecture.md.

Community
Intermediate
davepoondavepoon
3.4k

review-findings

Fixes critical and warning findings from QA code review reports with updated tests.

Community
Intermediate
AcczdyAcczdy
2

performing-web-application-penetration-test

Automate web application penetration testing following the OWASP WSTG with Burp Suite.

Community
Advanced
EngineerWithAIEngineerWithAI
4

sast-configuration

Configure Semgrep, SonarQube, and CodeQL for automated vulnerability detection.

Official
Intermediate