skills.rest
ntd237
ntd237COMMUNITY
Explore all skills by this author →
GitHub

security-scan

Audits source code, dependencies, and configurations for vulnerabilities and produces a severity-ranked report.

1|Updated Apr 20, 2026
Search Tags:#static analysis#code review#owasp#security audit#vulnerability scan#dependency check#secret detection
One-click install
npx skills add https://github.com/ntd237/draft_toolkits_20042026 --skill security-scan-ntd237
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-scan
Source: https://github.com/ntd237/draft_toolkits_20042026/tree/main/other-skills/security-scan
Command: npx skills add https://github.com/ntd237/draft_toolkits_20042026 --skill security-scan-ntd237

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security flaws like hardcoded secrets, injection vulnerabilities, and misconfigurations often hide in codebases until they are exploited, and manual reviews are slow and inconsistent. This Skill performs a structured, read-only static audit and delivers an evidence-backed, severity-ranked report. ## Core Features & Use Cases - Secrets & Credential Detection: Scans for hardcoded API keys, JWT secrets, database connection strings, and cloud tokens, masking them in output. - OWASP Top 10 & Crypto Audit: Detects SQL/NoSQL injection, XSS, SSRF, path traversal, broken authorization, weak JWT handling, and deprecated ciphers like MD5 or DES. - Configuration & Supply Chain Review: Flags debug mode in production, permissive CORS, containers running as root, and vulnerable or unpinned dependencies. - Use Case: Before a release, run the scan on your repository to receive a timestamped markdown report in docs/security-scan/ with Critical-to-Info findings, exact file locations, code snippets, and a prioritized remediation roadmap. ## Quick Start Ask the assistant to run a security scan on this repository and generate a severity-ranked vulnerability report.

Frequently Asked Questions about security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan my codebase for security vulnerabilities?▼

Run the security scan on your workspace or a target directory like src/ or api/. It statically audits code, dependencies, and configs for OWASP Top 10 flaws, secrets, and misconfigurations, then writes a severity-ranked markdown report to docs/security-scan/.

How to find hardcoded secrets and API keys in source code?▼

The scan detects hardcoded API keys, JWT secrets, database connection strings, and cloud tokens for AWS, GCP, Stripe, and GitHub. It distinguishes real secrets from placeholders and masks all credentials in the report, showing only the first and last four characters.

Does static security scanning modify my code?▼

No, the audit is strictly read-only and never edits, patches, or deletes project files. It also avoids running live exploits, fuzzing, or network penetration tests against running services.

What vulnerability types does a static security audit detect?▼

It covers SQL and NoSQL injection, XSS, SSRF, path traversal, insecure deserialization, broken authorization and IDOR, weak JWT verification, deprecated ciphers like MD5 and DES, permissive CORS, missing security headers, and vulnerable dependency versions.

What are the limitations of static security scanning?▼

Static analysis cannot confirm runtime exploitability, so it does not replace dynamic testing or penetration tests. Findings require defensible exploit paths for Critical or High severity, and CVE claims need verified package and version matches.

Related Skills

Explore More Software Engineering Skills→
blueraaiblueraai

Suggest Dependencies to Index

Parse manifest files and source imports to rank dependencies for indexing.

Official
Intermediate
AcendasAcendas
2

ship-bug

Generate a minimal bug spec and optional fix task for triage.

Official
Advanced
xalgordxalgord
954

building-devsecops-pipeline-with-gitlab-ci

Configure a GitLab CI/CD pipeline integrating SAST, DAST, container, dependency, and secret scanning.

Community
Intermediate
BagelHoleBagelHole
46

dast-scanning

Perform DAST scans on web applications and APIs with OWASP ZAP.

Community
Intermediate