skills.rest
TimeKast
TimeKastOFFICIAL
Explore all skills by this author →
WebsiteGitHub

vulnerability-scanner

Scan codebases for secrets, dependency risks, and insecure configurations.

Updated May 19, 2026
Search Tags:#security scanning#dependency audit#secure configuration#secrets detection#risk prioritization#code pattern analysis#owasp 2025
One-click install
npx skills add https://github.com/TimeKast/AgendaInteligente --skill vulnerability-scanner-timekast
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vulnerability-scanner
Source: https://github.com/TimeKast/AgendaInteligente/tree/main/.agent/skills/vulnerability-scanner
Command: npx skills add https://github.com/TimeKast/AgendaInteligente --skill vulnerability-scanner-timekast

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps teams detect common security weaknesses by mapping an application's attack surface, scanning for dangerous code patterns, exposed secrets, and insecure configuration, then prioritizing findings using an OWASP 2025-informed approach.

Core Features & Use Cases

  • OWASP 2025 Coverage: Focuses on high-impact risk areas including A01 (access control), A02 (misconfiguration), A03 (software supply chain), A04 (cryptographic/secret exposure), A05 (injection), and A10 (exception handling).
  • Supply Chain Integrity Checks: Validates the presence of lock files and runs dependency audits (e.g., npm audit) to surface critical/high dependency risks.
  • Secrets Exposure Detection: Searches code and config files for high-entropy credentials, tokens, private keys, and connection strings.
  • Dangerous Pattern Discovery: Flags risky constructs such as eval/exec usage, XSS sinks, SQL string concatenation indicators, and unsafe deserialization.
  • Configuration and Security Header Review: Detects debug modes, permissive CORS settings, and missing security header configuration signals.
  • Use Case: Before a release, run a targeted scan to quickly identify critical issues (like secrets or command injection patterns) and generate a JSON report for remediation planning.

Quick Start

Use the AI to run the vulnerability-scanner skill against your project by scanning the repository directory you want assessed and returning a structured JSON report with security findings.

Frequently Asked Questions about vulnerability-scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan my codebase for exposed secrets and dangerous code patterns?▼

To scan your codebase for exposed secrets and dangerous code patterns, run a vulnerability analysis script that uses regex-based detection to identify high-entropy credentials, eval usage, and SQL concatenation risks. It returns a structured JSON report detailing the findings.

Can I run a dependency audit and check lock files for supply chain risks?▼

Yes, you can run a dependency audit and check lock files for supply chain risks. The vulnerability scanner validates lock file presence and executes dependency audits like npm audit to surface critical and high-risk dependency vulnerabilities in your project.

What is the best way to detect insecure security configuration before a release?▼

The best way to detect insecure security configuration before a release is to validate security-related configuration indicators. The scanner detects debug modes, permissive CORS settings, and missing security headers to map your application's attack surface using an OWASP 2025-informed approach.

Does this security scanning cover OWASP 2025 risk categories?▼

Yes, this security scanning covers OWASP 2025 risk categories including access control, misconfiguration, software supply chain, cryptographic exposure, injection, and exception handling. It prioritizes findings based on these high-impact risk areas to focus remediation efforts.

How do I generate a structured report for security findings and remediation planning?▼

To generate a structured report for security findings and remediation planning, execute the script-based vulnerability scanning pipeline against your repository directory. It outputs a structured JSON report containing risk-prioritized security findings mapped to the OWASP 2025 standard.

Related Skills

Explore More Software Engineering Skills→
dthuy62dthuy62

ck:security-scan

Scan codebases for exposed secrets and security vulnerabilities.

Community
Intermediate
webrix-aiwebrix-ai
1

cloud-security-posture-review

Review AWS, GCP, and Azure environments against CIS benchmarks and write scored findings to Google Sheets.

Official
Advanced
zajcazajca
2

go-linting

Configure golangci-lint with recommended Go linters for static analysis.

Community
Basic
damianpapadopoulosdamianpapadopoulos
6

security-scanner

Scan code changes for security vulnerabilities using static and dynamic analysis tools.

Community
Advanced