skills.rest
Cbowcrptex
CbowcrptexCOMMUNITY
Explore all skills by this author →
Website𝕏@cbowcryptex_xyzGitHub

Vuln Scanner

Audit trending GitHub repositories for security vulnerabilities and disclose findings via PVR or dependency PRs.

Updated May 25, 2026
Search Tags:#github#security audit#sast#vulnerability scanning#semgrep#cve#responsible disclosure
One-click install
npx skills add https://github.com/Cbowcrptex/CBOWCRYPTEX --skill vuln-scanner-cbowcrptex
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Vuln Scanner
Source: https://github.com/Cbowcrptex/CBOWCRYPTEX/tree/main/skills/vuln-scanner
Command: npx skills add https://github.com/Cbowcrptex/CBOWCRYPTEX --skill vuln-scanner-cbowcrptex

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires semgrep, trufflehog, osv-scanner, slither-analyzer.

What problem does it solve? Scanning open-source repositories for vulnerabilities is easy, but disclosing findings responsibly is hard — publishing unpatched code flaws in public PRs creates zero-days. This Skill automates the full audit workflow while routing each finding to the correct disclosure channel. ## Core Features & Use Cases - Multi-scanner auditing: Runs Semgrep (SAST), TruffleHog (verified secrets), osv-scanner (dependency CVEs), and Slither (Solidity) against trending GitHub repositories. - Responsible disclosure routing: Sends code flaws and leaked secrets to GitHub Private Vulnerability Reporting, and opens public PRs only for already-disclosed dependency CVEs. - Triage and dedup: Manually verifies each scanner hit for exploitability, skips intentionally vulnerable teaching repos, and avoids re-scanning the same repo within 30 days. - Use Case: Point it at a trending TypeScript repo; it detects a verified leaked API key in git history, files a private advisory with rotation guidance, and logs the audit without exposing the secret publicly. ## Quick Start Run the vuln scanner on a trending GitHub repository and disclose any confirmed findings through the appropriate private or public channel.

Frequently Asked Questions about Vuln Scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan GitHub repositories for security vulnerabilities automatically?▼

Run Semgrep for SAST, TruffleHog for verified secrets, and osv-scanner for dependency CVEs against a cloned repository. Triage each hit by reading the surrounding code and confirming attacker reachability before reporting.

What is the difference between PVR and a public PR for vulnerability disclosure?▼

Private Vulnerability Reporting (PVR) creates a private GitHub security advisory for unpatched code flaws and leaked secrets. Public PRs are only appropriate for dependency bumps addressing CVEs that are already publicly disclosed.

Which scanners does this skill use for secrets and dependencies?▼

It uses TruffleHog with --only-verified for secrets that actually authenticate, osv-scanner for cross-ecosystem dependency CVEs, Semgrep for code-level SAST, and Slither for Solidity smart contracts.

What happens if a repository has no SECURITY.md or PVR enabled?▼

The skill skips code-flaw disclosure when no safe channel exists, logging the finding locally instead of publishing it. It may still run a dependency scan since CVE fixes are safe to submit publicly.

Why does the vulnerability scan report an error instead of clean results?▼

Scanner binaries are not pre-installed in sandboxed environments, and network installs may be blocked. If all scanners fail, the run is reported as an error rather than a clean audit to avoid false assurance.

Related Skills

Explore More Software Engineering Skills→
xg-gh-25xg-gh-25
36

github-trending

Fetch and analyze GitHub Trending repositories into a ranked list with language and star counts.

Community
Advanced
Mothership-FoundryMothership-Foundry

deal-with-security-advisory

Coordinate confidential GitHub security advisory responses with private forks and synchronized publication.

Official
Advanced
fusenginefusengine
22

cve-research

Query NVD, OSV.dev, GitHub Advisory Database, and Exa for dependency CVEs.

Community
Intermediate
shoji9x9shoji9x9

dependabot-alert-issue

Automate Dependabot alert triage and GitHub Issue creation.

Community
Advanced