Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/jwynia/agent-skills --skill security-scan- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads security-scan automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Security Scan
Comprehensive security vulnerability detection for codebases.
Quick Start
/security-scan # Full scan of current directory
/security-scan --scope src/ # Scan specific directory
/security-scan --quick # Fast scan (critical issues only)
/security-scan --focus injection # Focus on specific category
What This Skill Does
Analyzes code for security vulnerabilities across multiple categories:
- OWASP Top 10 - Industry-standard web vulnerability categories
- Secrets Detection - Hardcoded credentials, API keys, tokens
- Injection Flaws - SQL, XSS, command injection patterns
- Cryptographic Issues - Weak algorithms, insecure implementations
- Configuration Problems - Insecure defaults, misconfigurations
Scan Modes
Full Scan (Default)
Comprehensive analysis of all security categories.
/security-scan
Checks performed:
- All OWASP Top 10 categories
- Secrets and credential detection
- Dependency vulnerabilities (if package files exist)
- Configuration file review
Duration: 2-5 minutes depending on codebase size
Quick Scan
Fast check for critical and high-severity issues only.
/security-scan --quick
Checks performed:
- Critical injection patterns
- Exposed secrets
- Known dangerous functions
Duration: Under 1 minute
Focused Scan
Target specific vulnerability category.
/security-scan --focus <category>
Categories:
injection- SQL, XSS, command injectionsecrets- Credentials, API keys, tokenscrypto- Cryptographic weaknessesauth- Authentication/authorization issuesconfig- Configuration security
Output Format
Severity Levels
| Level | Icon | Meaning | Action Required |
|---|---|---|---|
| CRITICAL | [!] | Exploitable vulnerability | Immediate fix |
| HIGH | [H] | Serious security risk | Fix before deploy |
| MEDIUM | [M] | Potential vulnerability | Plan to address |
| LOW | [L] | Minor issue or hardening | Consider fixing |
| INFO | [i] | Informational finding | Awareness only |
Finding Format
[SEVERITY] CATEGORY: Brief description
File: path/to/file.ext:line
Pattern: What was detected
Risk: Why this is dangerous
Fix: How to remediate
Summary Report
SECURITY SCAN RESULTS
=====================
Scope: src/
Files scanned: 127
Duration: 45 seconds
FINDINGS BY SEVERITY
Critical: 2
High: 5
Medium: 12
Low: 8
TOP ISSUES
1. [!] SQL Injection in src/api/users.ts:45
2. [!] Hardcoded AWS key in src/config.ts:12
3. [H] XSS vulnerability in src/components/Comment.tsx:89
...
Run `/security-scan --details` for full report.
OWASP Top 10 Coverage
| # | Category | Detection Approach |
|---|---|---|
| A01 | Broken Access Control | Authorization pattern analysis |
| A02 | Cryptographic Failures | Weak crypto detection |
| A03 | Injection | Pattern matching + data flow |
| A04 | Insecure Design | Security control gaps |
| A05 | Security Misconfiguration | Config file analysis |
| A06 | Vulnerable Components | Dependency scanning |
| A07 | Auth Failures | Auth pattern review |
| A08 | Data Integrity Failures | Deserialization checks |
| A09 | Logging Failures | Audit log analysis |
| A10 | SSRF | Request pattern detection |
See references/owasp/ for detailed detection rules per category.
Detection Patterns
Injection Detection
SQL Injection:
- String concatenation in queries
- Unsanitized user input in database calls
- Dynamic query construction
Cross-Site Scripting (XSS):
- innerHTML assignments with user data
- document.write() with dynamic content
- Unescaped template interpolation
Command Injection:
- exec(), system(), popen() with user input
- Shell command string construction
- Unsanitized subprocess arguments
See references/patterns/ for language-specific patterns.
Secrets Detection
High-Confidence Patterns:
AWS Access Key: AKIA[0-9A-Z]{16}
AWS Secret Key: [A-Za-z0-9/+=]{40}
GitHub Token: gh[pousr]_[A-Za-z0-9]{36,}
Stripe Key: sk_live_[A-Za-z0-9]{24,}
Private Key: -----BEGIN (RSA |EC )?PRIVATE KEY-----
Medium-Confidence Patterns:
Generic API Key: api[_-]?key.*[=:]\s*['"][a-zA-Z0-9]{16,}
Password in Code: password\s*[=:]\s*['"][^'"]+['"]
Connection String: (mysql|postgres|mongodb)://[^:]+:[^@]+@
Cryptographic Weaknesses
Weak Algorithms:
- MD5 for password hashing
- SHA1 for security purposes
- DES/3DES encryption
- RC4 stream cipher
Implementation Issues:
- Hardcoded encryption keys
- Weak random number generation
- Missing salt in password hashing
- ECB mode encryption
Integration with Other Skills
With /secrets-scan
Focused deep-dive on credential detection:
/secrets-scan # Dedicated secrets analysis
/secrets-scan --entropy # High-entropy string detection
With /dependency-scan
Package vulnerability analysis:
/dependency-scan # Check all dependencies
/dependency-scan --fix # Auto-fix where possible
With /config-scan
Infrastructure and configuration review:
/config-scan # All config files
/config-scan --docker # Container security
/config-scan --iac # Infrastructure as Code
Scan Execution Protocol
Phase 1: Discovery
1. Identify project type (languages, frameworks)
2. Locate relevant files (source, config, dependencies)
3. Determine applicable security rules
Phase 2: Static Analysis
1. Pattern matching for known vulnerabilities
2. Data flow analysis for injection paths
3. Configuration review
Phase 3: Secrets Scanning
1. High-confidence pattern matching
2. Entropy analysis for potential secrets
3. Git history check (optional)
Phase 4: Dependency Analysis
1. Parse package manifests
2. Check against vulnerability databases
3. Identify outdated packages
Phase 5: Reporting
1. Deduplicate findings
2. Assign severity scores
3. Generate actionable report
4. Provide remediation guidance
Configuration
Project-Level Config
Create .security-scan.yaml in project root:
# Scan configuration
scan:
exclude:
- "node_modules/**"
- "vendor/**"
- "**/*.test.ts"
- "**/__mocks__/**"
# Severity thresholds
thresholds:
fail_on: critical # critical, high, medium, low
warn_on: medium
# Category toggles
categories:
injection: true
secrets: true
crypto: true
auth: true
config: true
dependencies: true
# Custom patterns
patterns:
secrets:
- name: "Internal API Key"
pattern: "INTERNAL_[A-Z]{3}_KEY_[a-zA-Z0-9]{32}"
severity: high
Ignore Patterns
Create .security-scan-ignore for false positives:
# Ignore specific files
src/test/fixtures/mock-credentials.ts
# Ignore specific lines (use inline comment)
# security-scan-ignore: test fixture
const mockApiKey = "sk_test_fake123";
Command Reference
| Command | Description |
|---|---|
/security-scan | Full security scan |
/security-scan --quick | Critical issues only |
/security-scan --scope <path> | Scan specific path |
/security-scan --focus <cat> | Single category |
/security-scan --details | Verbose output |
/security-scan --json | JSON output |
/security-scan --fix | Auto-fix where possible |
Related Skills
/secrets-scan- Deep secrets detection/dependency-scan- Package vulnerability analysis/config-scan- Configuration security review/review-code- General code review (includes security)
References
references/owasp/- OWASP Top 10 detection detailsreferences/patterns/- Language-specific vulnerability patternsreferences/remediation/- Fix guidance by vulnerability typeassets/severity-matrix.md- Severity scoring criteria
FAQ
What does the security-scan skill do?
Scan code for security vulnerabilities including OWASP Top 10, secrets, and misconfigurations. Use when you need comprehensive security analysis of a codebase.
How do I install security-scan?
Run npx skills add https://github.com/jwynia/agent-skills --skill security-scan in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/security-scan/ (personal) or .claude/skills/security-scan/ (project).
Which AI agents can use security-scan?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is security-scan safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains security-scan?
It is published by jwynia in jwynia/agent-skills. It has 472 recorded installs.
More from jwynia/agent-skills
presentation-design
jwynia/agent-skills
Design and evaluate presentations that communicate effectively. Use when designing a presentation, creating slides, getting presentation feedback, structuring a talk, or reviewing slides. Keywords: presentation, slides, talk, PowerPoint, Keynote, reveal.js.
frontend-design
jwynia/agent-skills
Create distinctive, production-grade frontend interfaces with high design quality. Provides analysis tools for auditing existing designs and generation tools for creating color palettes, typography systems, design tokens, and component templates. Supports React, Vue, Svelte, and vanilla HTML/CSS. Use when building web components, pages, or applications. Keywords: design, UI, frontend, CSS, components, palette, typography, tokens, accessibility.
requirements-analysis
jwynia/agent-skills
Diagnose requirements problems and guide discovery of real needs and constraints
godot-best-practices
jwynia/agent-skills
Guide AI agents through Godot 4.x GDScript coding best practices including scene organization, signals, resources, state machines, and performance optimization. This skill should be used when generating GDScript code, creating Godot scenes, designing game architecture, implementing state machines, object pooling, save/load systems, or when the user asks about Godot patterns, node structure, or GDScript standards. Keywords: godot, gdscript, game development, signals, resources, scenes, nodes, state machine, object pooling, save system, autoload, export, type hints.
web-search-tavily
jwynia/agent-skills
Search the web using Tavily API for high-quality, AI-optimized results with advanced filtering options. Use when you need structured search results, domain filtering, relevance scores, or AI-generated answer summaries. Requires TAVILYAPIKEY. Keywords: tavily, advanced search, filtered search, domain filtering, relevance scoring.
godot-asset-generator
jwynia/agent-skills
Generate game assets using AI image generation APIs (DALL-E, Replicate, fal.ai) and prepare them for Godot. Covers the full art pipeline from concept art and style guides to final sprites, sprite sheets, and import configuration. This skill should be used when creating game art, generating sprites, making tilesets, creating UI elements, or preparing assets for Godot import. Keywords: game assets, AI art, DALL-E, Replicate, fal.ai, sprite sheet, tileset, Godot, pixel art, character sprite, game art, texture, animation frames.
Popular security skills
azure-compliance
microsoft/azure-skills
Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
minimal-run-and-audit
lllllllama/rigorpilot-skills
Rigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation command and write standardized reprooutputs/ files, including patch notes when repository files changed. Do not use for training execution, initial repo intake, generic environment setup, paper lookup, target selection, hidden scientific-meaning changes, or end-to-end orchestration by itself.
seo-audit
coreyhaines31/marketingskills
When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost rankings," "not showing up in Google," "site isn't ranking," "Google update hit me," "page speed," "core web vitals," "crawl errors," "indexing issues," "stuck on page 2," "striking distance keywords," "title tag rewrite," "low CTR," "local SEO," "Google Business Profile," or "map pack." Use this even if the user just says something vague like "my SEO is bad" or "help with SEO" — start with an audit. For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema. For AI search optimization, see ai-seo.
firebase-security-rules-auditor
firebase/agent-skills
Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.
audit
pbakaus/impeccable
Run technical quality checks across accessibility, performance, theming, responsive design, and anti-patterns. Generates a scored report with P0-P3 severity ratings and actionable plan. Use when the user wants an accessibility check, performance audit, or technical quality review.
competitors
coreyhaines31/marketingskills
When the user wants to create competitor comparison or alternative pages for SEO and buyer-facing use. Also use when the user mentions 'alternative page,' 'vs page,' 'competitor comparison,' 'comparison page,' '[Product] vs [Product],' '[Product] alternative,' 'competitive landing pages,' 'how do we compare to X,' 'competitor teardown,' 'audit our competitor pages,' 'are our comparison pages out of date,' or 'competitive asset audit.' Use this for any content that positions your product against competitors. Covers four formats: singular alternative, plural alternatives, you vs competitor, and competitor vs competitor. For auditing existing claims (not researching competitors from scratch, which is competitor-profiling; not technical SEO on these pages, which is seo-audit), use the asset audit here. For internal battle cards and sales-specific competitor docs, see sales-enablement.