skills.rest
beliciobcardoso
beliciobcardosoCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

vulnerability-scanner

Scan codebases for secrets, dangerous patterns, dependency vulnerabilities, and misconfigurations using OWASP 2025 principles.

Updated Mar 17, 2026
Search Tags:#security#owasp#code audit#secret detection#supply chain#vulnerability scanning#risk prioritization
One-click install
npx skills add https://github.com/beliciobcardoso/mcp-postgres --skill vulnerability-scanner-beliciobcardoso
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vulnerability-scanner
Source: https://github.com/beliciobcardoso/mcp-postgres/tree/main/.agent/skills/vulnerability-scanner
Command: npx skills add https://github.com/beliciobcardoso/mcp-postgres --skill vulnerability-scanner-beliciobcardoso

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Security reviews often miss critical issues because teams lack a structured methodology and automated validation. This Skill combines OWASP Top 10:2025 expertise with an automated scanner that detects hardcoded secrets, injection-prone code patterns, supply chain risks, and insecure configurations in any project. ## Core Features & Use Cases - Automated Security Scanning: Run security_scan.py to detect secrets (AWS keys, JWTs, database strings), dangerous patterns (eval, SQL concatenation, unsafe deserialization), missing lock files, and misconfigurations (debug mode, CORS wildcards). - OWASP 2025 Methodology: Apply structured guidance covering all ten risk categories including the new Supply Chain Security (A03) and Exceptional Conditions (A10), with risk prioritization using CVSS and EPSS scores. - Audit Checklists: Use ready-made checklists for authentication, API security, data protection, and security headers during manual reviews. - Use Case: Before deploying a web application, run the scanner to catch a hardcoded database connection string and an eval() call, then use the risk prioritization matrix to decide which findings block the release. ## Quick Start Ask the AI to run a security scan on your project directory and report any critical findings with remediation guidance.

Frequently Asked Questions about vulnerability-scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan a project for hardcoded secrets and API keys?▼

Run security_scan.py with the project path to detect AWS keys, JWT tokens, database connection strings, private keys, and passwords using regex patterns. Findings are classified by severity (critical, high, medium) and reported with file locations.

How to check code for SQL injection and XSS vulnerabilities?▼

The pattern scanner detects SQL string concatenation, f-string queries, eval(), exec(), dangerouslySetInnerHTML, and innerHTML assignments across JS, TS, Python, Go, Java, Ruby, and PHP files. Each finding includes the file, line number, and risk category.

What is new in OWASP Top 10 2025 compared to 2021?▼

OWASP 2025 adds Supply Chain Security (A03) and Exceptional Conditions (A10) as new categories, merges SSRF into Broken Access Control (A01), and elevates Security Misconfiguration (A02) due to cloud and container risks.

Does the security scanner require external dependencies?▼

No, security_scan.py uses only Python standard library modules (re, os, json, subprocess, argparse). The npm audit integration is optional and only activates when a package.json file exists in the scanned project.

How do I prioritize which vulnerabilities to fix first?▼

Combine CVSS base severity with EPSS exploit likelihood scores. Treat actively exploited vulnerabilities (EPSS above 0.5) as critical, CVSS 9.0+ as high priority, and factor in asset value and internet exposure for medium scores.

What are the limitations of regex-based secret scanning?▼

Regex patterns can produce false positives on test fixtures and miss obfuscated or encoded secrets. The scanner skips dependency directories like node_modules but cannot detect secrets in binary files or environment variables set outside the codebase.

Related Skills

Explore More Software Engineering Skills→
0xHoneyJar0xHoneyJar
1

deploy

Deploy code from the current directory to Railway using railway up.

Official
Intermediate
nexus-substratenexus-substrate
18

security-scanning

Triage CodeQL and secret scanning alerts, fix findings, and classify secrets.

Official
Advanced
goodstoriesworldgoodstoriesworld

coco-intel-briefing

Aggregate RSS feeds, summarize articles, and generate structured Markdown briefings.

Official
Advanced
EngineerWithAIEngineerWithAI
4

sast-configuration

Configure Semgrep, SonarQube, and CodeQL for automated vulnerability detection.

Official
Intermediate