security-scanner

# Security Scanner Skill ## Overview Runs comprehensive security scans including SAST scanning with Semgrep/CodeQL, dependency vulnerability scanning with Snyk/OWASP, secret detection, and container image scanning. ## Capabilities - SAST scanning (Semgrep, CodeQL) - Dependency vulnerability scanning (Snyk, OWASP Dependency-Check) - Secret detection (git-secrets, truffleHog, gitleaks) - Container image scanning (Trivy, Grype) - License compliance checking - SBOM generation - CVE database lookup ## Target Processes - security-architecture-review - iac-review ## Input Schema ```json { "type": "object", "required": ["targets"], "properties": { "targets": { "type": "array", "items": { "type": "string" }, "description": "Paths to scan" }, "scanTypes": { "type": "array", "items": { "type": "string", "enum": ["sast", "dependencies", "secrets", "containers", "licenses"] }, "default": ["sast", "dependencies", "secrets"] }, "tools": { "type": "object", "properties": { "sast": { "type": "string", "enum": ["semgrep", "codeql"], "default": "semgrep" }, "dependencies": { "type": "string", "enum": ["snyk", "owasp", "npm-audit"], "default": "snyk" }, "secrets": { "type": "string", "enum": ["gitleaks", "trufflehog"], "default": "gitleaks" } } }, ...