What problem does it solve? Security reviews are often inconsistent, miss critical issues like hardcoded secrets or vulnerable dependencies, and fail to prioritize findings by real exploitability. This Skill provides a structured methodology and an automated scanner to detect, classify, and prioritize vulnerabilities across code, dependencies, and configuration. ## Core Features & Use Cases - Automated Security Scanning: Run scripts/security_scan.py to detect hardcoded secrets, dangerous code patterns (eval, SQL concatenation, unsafe deserialization), missing lock files, and insecure configurations, with JSON or summary output. - OWASP 2025 Alignment: Built-in guidance and checklists covering the OWASP Top 10:2025, including the new Supply Chain Security (A03) and Exceptional Conditions (A10) categories. - Risk Prioritization: Combines CVSS, EPSS, asset value, and exposure to classify findings as Critical, High, Medium, or Low with actionable remediation guidance. - Use Case: Before deploying a web application, run the scanner against the project directory to catch exposed API keys, npm dependency vulnerabilities, and missing security headers, then use the checklists to verify authentication and data protection controls. ## Quick Start Ask the AI to scan your project directory for security vulnerabilities and report any critical findings with remediation steps.
