skills.rest
DevayoshaUS
DevayoshaUSCOMMUNITY
Explore all skills by this author →
GitHub

vulnerability-scanner

Scan projects for secrets, dangerous code patterns, dependency vulnerabilities, and misconfigurations.

41|Updated Apr 14, 2026
Search Tags:#code analysis#security#python#owasp#secret detection#dependency audit#vulnerability scanning
One-click install
npx skills add https://github.com/DevayoshaUS/Women-scholarship --skill vulnerability-scanner-devayoshaus
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vulnerability-scanner
Source: https://github.com/DevayoshaUS/Women-scholarship/tree/main/hackathon-main%20%281%29/hackathon-main/.agent/skills/vulnerability-scanner
Command: npx skills add https://github.com/DevayoshaUS/Women-scholarship --skill vulnerability-scanner-devayoshaus

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Security issues like hardcoded credentials, injection-prone code, vulnerable dependencies, and misconfigured settings often slip into codebases unnoticed. This Skill provides a structured methodology based on OWASP Top 10:2025 plus an automated Python scanner to detect and prioritize these risks before attackers do. ## Core Features & Use Cases - Automated Security Scanning: Run scripts/security_scan.py to detect hardcoded secrets (API keys, AWS credentials, JWTs), dangerous code patterns (eval, SQL string concatenation, unsafe deserialization), missing lock files, and insecure configurations. - OWASP 2025 Guidance: Apply up-to-date checklists covering Broken Access Control, Supply Chain Security, and Exceptional Conditions with risk prioritization using CVSS and EPSS scores. - Use Case: Before deploying a web application, run the scanner against your project directory to catch exposed secrets and critical dependency vulnerabilities, then use the included checklists to audit authentication, API security, and data protection controls. ## Quick Start Run the security scan script against my project directory and summarize any critical or high severity findings with remediation advice.

Frequently Asked Questions about vulnerability-scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan a project for hardcoded secrets and API keys?▼

Run security_scan.py with the project path and the secrets scan type to detect API keys, AWS credentials, JWTs, database connection strings, and private keys. It searches code and config files using regex patterns and reports findings by severity.

How to check for dangerous code patterns like eval or SQL injection?▼

Use the patterns scan type to find eval(), exec(), SQL string concatenation, unsafe pickle deserialization, innerHTML assignments, and disabled SSL verification. Each finding includes the file, line number, severity, and risk category.

Does the security scanner check npm dependencies for vulnerabilities?▼

Yes, the dependencies scan runs npm audit when a package.json exists and reports critical and high severity vulnerability counts. It also verifies that lock files like package-lock.json or yarn.lock are present for supply chain integrity.

What languages and file types does the vulnerability scanner support?▼

The scanner analyzes JavaScript, TypeScript, JSX, TSX, Python, Go, Java, Ruby, and PHP source files, plus JSON, YAML, TOML, and env configuration files. It skips node_modules, .git, dist, build, and virtual environment directories.

What are the limitations of regex-based secret scanning?▼

Regex patterns can produce false positives on placeholder values and miss obfuscated or encoded secrets. Findings should be manually verified, and the scan complements rather than replaces dedicated tools like git history scanners.

Related Skills

Explore More Software Engineering Skills→
EmeaAppGbbEmeaAppGbb

dependency-inventory

Identify and document project dependencies, versions, and purposes from manifests and lock files.

Official
Advanced
nexus-substratenexus-substrate
18

security-scanning

Triage CodeQL and secret scanning alerts, fix findings, and classify secrets.

Official
Advanced
p-o-ke-naep-o-ke-nae

attack-tree-construction

Build attack trees with OR, AND, and leaf nodes for threat modeling.

Community
Advanced
EtroxTaranEtroxTaran

security-scan

Automates security audits combining SAST, MLOps-driven fleet monitoring, and secret detection for GitOps workflows.

Community
Advanced