security-scan

Q: How do I install security-scan?

Run npx skills add https://github.com/codewithmukesh/dotnet-claude-kit --skill security-scan in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/security-scan/ (personal) or .claude/skills/security-scan/ (project).

by codewithmukeshSecurity

Deep security scanning for .NET applications across 6 layers: vulnerable packages, secrets detection, OWASP code patterns, auth configuration, CORS policy, and data protection. Produces severity-rated findings with specific remediation steps. Load this skill when: "security scan", "security audit", "check for vulnerabilities", "find secrets", "OWASP", "auth review", "CORS check", "security review", "penetration test prep", "CVE check", "vulnerability scan", "hardcoded password", "data protection", "security posture".

Installs: 2.9K
Last 24h: +56
Trending rank: #3117
Security: Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/codewithmukesh/dotnet-claude-kit --skill security-scan

01
Install
Run the command in your project. The CLI asks which agents to install for.
02
Describe the task
Ask your agent for something this skill covers. It loads security-scan automatically when relevant.
03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

/security-scan — 6-Layer Security Pipeline

What

Runs a defense-in-depth static scan across 6 layers. A project with zero CVEs can still have hardcoded secrets, SQL injection, and missing auth — each layer catches a different vulnerability class. Findings map to the OWASP Top 10:2025 taxonomy and are rated Critical/High/Medium/Low by exploitability, impact, and exposure — a Critical SQL injection on a public endpoint outranks a Low info-disclosure on an admin page.

Detection patterns, OWASP mappings, remediation code, and the report template live in references/scan-layers.md — read it before executing.

Honesty rule: this is static analysis, not a penetration test. It catches known patterns but misses business-logic flaws, complex authorization bypasses, and runtime-only vulnerabilities. Every report states this.

When

Pre-release security gate — full scan, non-negotiable before production
"Security scan", "security audit", "find secrets", "CVE check", "OWASP"
After a dependency update (Layer 1), auth changes (Layer 4), config changes (Layer 2), or logging changes (Layer 6)
Pre-pentest preparation — fix static issues before paying for a pentest
Incident response and quarterly reviews

How

Step 1: Choose Layers

Scenario	Layers
Pre-release gate / pentest prep / incident / quarterly	All 6
After dependency update	1
New endpoint added	3, 4, 5
Auth system changes	4
Config file changes	2
Logging changes	6
Public API exposure	3, 4, 5
Internal-only service	1, 2, 3

Step 2: Execute the Layers

Read references/scan-layers.md for the detection patterns per layer. Delegate deep auth and secrets review to the security-auditor agent, pairing the authentication and configuration skills.

#	Layer	OWASP 2025	Method
1	Package vulnerabilities	A03 Supply Chain	`dotnet list package --vulnerable --include-transitive`
2	Secrets detection	—	Pattern scan over .cs/.json/.yml/.xml/.config
3	OWASP code patterns	A05 Injection, A08 Integrity, A04 Crypto, A01 Access Control	Source scan: raw SQL, `Html.Raw`, `BinaryFormatter`, MD5/SHA1, IDOR
4	Auth configuration	A07 Authentication, A01 Access Control	`get_endpoint_map` — every route's auth posture in one call; flag `unmarked` endpoints; then JWT validation settings
5	CORS policy	A02 Misconfiguration	Wildcard origins, credentials combos, method/header breadth
6	Data protection	A04 Crypto, A09 Logging & Alerting	PII in logs, over-broad responses, plaintext sensitive storage

Step 3: Rate with Context

Severity must match actual risk — over-classification causes alert fatigue and buries the real Critical:

Test-fixture "secrets" and appsettings.Development.json values are expected — skip or mark INFO, don't flag as HIGH
A missing XML comment is never a security finding
Reserve Critical for exploitable-now issues: injection on public endpoints, exposed production secrets, auth bypass

Step 4: Report

Every finding: [SEVERITY] file:line — title, OWASP category, what's wrong, impact if exploited, and remediation code (before/after). Produce the summary table + per-layer status table from the reference template, prefixed with the static-analysis disclaimer.

Example

User: /security-scan before we ship

Claude: Running all 6 layers...

| Layer | Status | Findings |
|-------|--------|----------|
| 1. Packages | PASS | 0 CVEs (142 packages incl. transitive) |
| 2. Secrets | PASS | 0 real secrets (2 dev-only values skipped) |
| 3. OWASP Patterns | FAIL | 1 SQL injection |
| 4. Auth Config | WARN | 2 endpoints missing explicit auth attributes |
| 5. CORS | PASS | Explicit origins from configuration |
| 6. Data Protection | WARN | Customer email logged at Information level |

[HIGH] SearchOrders.cs:34 — SQL Injection (A05:2025)
  FromSqlRaw($"...LIKE '%{search}%'") → attacker controls the query.
  Fix: db.Orders.Where(o => EF.Functions.Like(o.Name, $"%{search}%"))

[MEDIUM] OrderEndpoints.cs:18,31 — no [Authorize]/[AllowAnonymous]; behavior
  depends on ambient global policy. Make intent explicit per endpoint.

[LOW] OrderPlacedHandler.cs:22 — PII in logs (A09:2025). Log CustomerId, not email.

Note: static analysis only — this does not replace a penetration test.

references/scan-layers.md — detection patterns, OWASP 2025 mappings, report template
/verify — Phase 5 runs a lightweight version of this scan per change set
/health-check — Dimension 7 (Security Posture) is the spot-check version
authentication / configuration — remediation patterns for Layers 4 and 2

FAQ

What does the security-scan skill do?

How do I install security-scan?

Run npx skills add https://github.com/codewithmukesh/dotnet-claude-kit --skill security-scan in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/security-scan/ (personal) or .claude/skills/security-scan/ (project).

Which AI agents can use security-scan?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is security-scan safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains security-scan?

It is published by codewithmukesh in codewithmukesh/dotnet-claude-kit. It has 2,912 recorded installs.