skills.rest
fusengine
fusengineCOMMUNITY
Explore all skills by this author →
Website𝕏@fusengineGitHub

security-scan

Scans codebases for OWASP Top 10 vulnerabilities across six programming languages.

1|Updated Jul 29, 2026
Search Tags:#sql injection#xss#owasp#security scan#code audit#vulnerability detection#graphql security
One-click install
npx skills add https://github.com/fusengine/kimi-code --skill security-scan-fusengine
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-scan
Source: https://github.com/fusengine/kimi-code/tree/main/plugins/security-expert/skills/security-scan
Command: npx skills add https://github.com/fusengine/kimi-code --skill security-scan-fusengine

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires @fusengine/harness, and includes references (resource) components.

What problem does it solve? Manually auditing a codebase for vulnerabilities like XSS, SQL injection, hardcoded secrets, and insecure deserialization is slow and error-prone. This Skill automates the detection of OWASP Top 10 vulnerability patterns across JavaScript/TypeScript, PHP, Python, Swift/iOS, Go, and Rust projects. ## Core Features & Use Cases - Multi-language pattern scanning: Detects the project language from marker files (package.json, composer.json, go.mod, Cargo.toml) and applies 10-25+ language-specific grep patterns per language. - OWASP Top 10 mapping: Maps every finding to an OWASP 2025 category (A01-A10) with severity ratings and remediation guidance, including GraphQL-specific checks for introspection, depth limiting, and batching attacks. - Structured reporting and fix delegation: Generates a severity-ranked scan report and delegates concrete fixes to a sniper agent with file:line, vulnerability, and fix details. - Use Case: Before a release, run a scan on a Node.js API to surface hardcoded API keys, eval() usage, and SSRF-prone fetch calls, then hand the findings to an agent for remediation. ## Quick Start Scan this project for security vulnerabilities and generate an OWASP-mapped report of all findings.

Frequently Asked Questions about security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan a codebase for OWASP Top 10 vulnerabilities?▼

Run the security scan workflow, which detects the project language from marker files, loads matching vulnerability patterns, executes the harness scanner, and maps findings to OWASP categories. Results are compiled into a severity-ranked report with remediation guidance.

What languages does automated security scanning support?▼

The scan supports JavaScript/TypeScript, PHP, Python, Swift/iOS, Go, and Rust. Each language has 10-25+ dedicated grep patterns covering injection, weak cryptography, insecure deserialization, and hardcoded secrets.

Can I scan a GraphQL API for security issues?▼

Yes, GraphQL-specific patterns cover introspection exposure, missing depth and complexity limits, batching attacks, field-level authorization gaps, and missing persisted query configuration. These checks load when a GraphQL endpoint is detected.

Does the security scan apply fixes automatically?▼

No, the scan only detects and reports vulnerabilities. It delegates fixes to a separate sniper agent, passing file path, line number, vulnerability type, and the recommended fix for each finding.

What are the limitations of pattern-based vulnerability scanning?▼

Pattern matching can produce false positives on safe code that resembles risky patterns and may miss vulnerabilities requiring dataflow analysis. Findings should be reviewed manually, and dependency CVE auditing requires separate tools like npm audit or pip-audit.

Related Skills

Explore More Software Engineering Skills→
ForgePlanForgePlan
3

bmad-init

Detect project stacks and initialize BMAD pipeline state files.

Official
Intermediate
awsaws
2.5k

scanning-with-aws-security-agent

Runs full-repository security scans via the AWS Security Agent service and returns ranked findings.

Official
Advanced
softsparksoftspark
161

cve-scan

Detect known CVEs in project dependencies using native package manager audit tools.

Community
Intermediate
jassicsjassics
6

mobile-pentest

Automate MASTG-based mobile penetration tests on Android and iOS apps.

Community
Advanced