skills.rest
juanjo-zurich
juanjo-zurichCOMMUNITY
Explore all skills by this author →
GitHub

security-scanner

Scan codebases for OWASP Top 10 vulnerabilities, exposed secrets, and attack surface exposure.

Updated Apr 4, 2026
Search Tags:#code review#sql injection#owasp#security audit#secret detection#vulnerability scanning#attack surface
One-click install
npx skills add https://github.com/juanjo-zurich/juarvis-v4 --skill security-scanner-juanjo-zurich
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-scanner
Source: https://github.com/juanjo-zurich/juarvis-v4/tree/main/plugins/security/skills/security-scanner
Command: npx skills add https://github.com/juanjo-zurich/juarvis-v4 --skill security-scanner-juanjo-zurich

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security issues like SQL injection, hardcoded credentials, and misconfigured endpoints often go unnoticed until they are exploited. This Skill performs a structured security audit of your project based on the OWASP Top 10 2025 checklist, detects exposed secrets, and maps the attack surface so you can fix risks before deployment. ## Core Features & Use Cases - OWASP Top 10 2025 Audit: Systematically checks for broken access control, injection flaws, cryptographic failures, insecure design, SSRF, and more. - Secret Detection: Scans for API keys, tokens, passwords, AWS credentials, private keys, and URLs with embedded credentials using regex patterns. - Attack Surface Mapping: Identifies public endpoints, user inputs, third-party integrations, and exposed infrastructure. - Use Case: Before deploying a new release, run a security audit to receive a prioritized report with critical findings, proof-of-concept evidence, and concrete code fixes for each vulnerability. ## Quick Start Run a security audit of this project and report any OWASP vulnerabilities or exposed secrets with recommended fixes.

Frequently Asked Questions about security-scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan my codebase for OWASP Top 10 vulnerabilities?▼

Run a security audit that checks each OWASP Top 10 2025 category, from broken access control to SSRF. The scan produces a report listing critical and high findings with file locations, proof-of-concept examples, and concrete code fixes.

How to detect hardcoded secrets and API keys in code?▼

Use regex-based secret detection to find API keys, tokens, passwords, AWS access keys (AKIA pattern), private key blocks, and URLs containing embedded credentials. Findings report only the file and line location, never the secret value itself.

What is attack surface mapping in a security audit?▼

Attack surface mapping identifies all publicly exposed endpoints, user input vectors like forms and file uploads, third-party integrations such as webhooks and OAuth, and accessible infrastructure like databases and message queues.

Does the security audit report include actual secret values?▼

No. The report never includes real secrets, only their file location, type, and line number. This prevents further exposure while still telling you exactly what to rotate and where to move credentials to environment variables.

When should I run a security scan on my project?▼

Run it before deployments, when handling sensitive code changes, or whenever a security audit is requested. Regular scans catch vulnerable dependencies, missing security headers, and injection flaws before they reach production.

Related Skills

Explore More Software Engineering Skills→
sbknanasbknana
10

bootstrap-tests

Generate pytest configuration, fixtures, and sample tests for Python projects.

Community
Advanced
nexus-substratenexus-substrate
18

security-scanning

Triage CodeQL and secret scanning alerts, fix findings, and classify secrets.

Official
Advanced
latestaiagentslatestaiagents
5

dependency-vulnerability

Identify and remediate known vulnerabilities in third-party software dependencies.

Official
Advanced
doctordukedoctorduke

security-scanning-suite

Automate SAST, DAST, dependency, secret, and container security scans.

Community
Advanced