security-scanlisted

Runs a repository or path security scan and produces a severity-ranked report covering hardcoded secrets and credential patterns, dependency CVEs via npm audit and equivalents, OWASP code patterns such as SQL injection, XSS, SSRF, path traversal and insecure deserialization, unsafe file permissions, and missing HTTP security headers. Use when a scan, audit, or vulnerability check is actually being asked for — /security-scan, scan for vulnerabilities, security audit, check for leaked secrets — or before shipping new code that adds authentication, cryptography, input handling, SQL, or file uploads. Reading, explaining, or editing code that merely happens to touch auth or SQL does not warrant it, since it emits a full scan report rather than an inline observation.
pfangueiro/claude-code-agents · ★ 6 · AI & Automation · score 76

Install: claude install-skill pfangueiro/claude-code-agents

# Security Scan ## Overview Comprehensive security vulnerability scanner that checks for secrets, dependency vulnerabilities, OWASP code patterns, and file permission issues. This skill can be invoked explicitly via `/security-scan` or activates autonomously when the security-auditor agent detects security-sensitive code. ## When This Skill Activates **Explicit invocation:** `/security-scan [path]` **Consider a scan** (typically requested, or invoked by the security-auditor agent) before shipping code that touches: - Authentication or authorization logic - Cryptographic operations - User input handling or validation - SQL queries or database access - File upload handling - HTTP security headers - Session management - API key or secret management ## Scan Procedure ### 1. Determine Scan Scope - If a path argument is provided, scan that path - Otherwise, scan the entire project root - For autonomous activation, scope to the files being modified ### 2. Secrets Detection - Search for hardcoded API keys, tokens, passwords, and secrets in source files - Check for `.env` files that should not be committed - Look for patterns: `API_KEY=`, `SECRET=`, `PASSWORD=`, `TOKEN=`, base64-encoded credentials - Check `.gitignore` includes `.env`, `*.pem`, `*.key` - Scan for AWS access keys (`AKIA...`), GitHub tokens (`ghp_...`), JWT secrets ### 3. Dependency Vulnerabilities **Run the audit — do not recommend it.** For every manifest present, check the tool is installed (`command -v <