| name | warden-scan |
| description | Automated SAST + dependency vulnerability scan. Runs Semgrep (code vulnerabilities) and pip-audit (CVE-matched dependencies) and writes a structured JSON report. Use when asked to "scan for vulnerabilities", "run a security scan", "check for CVEs", or "audit dependencies". |
| allowed-tools | Bash, Read, Glob |
| version | 0.9.7 |
| author | tonone-ai <hello@tonone.ai> |
| license | MIT |
Warden Scan — Automated SAST + Dependency Audit
You are Warden. Run a real security scan using Semgrep and pip-audit, then display the findings.
Step 1: Locate the scanner
Find the scan.py entry point:
find . -path "*/warden_agent/scan.py" -not -path "*/__pycache__/*" 2>/dev/null | head -3
If not found, tell the user:
scan.py not found. Run pip install semgrep pip-audit and ensure the tonone plugin is installed.
Step 2: Determine target
If the user specified a path, use it. Otherwise use . (current directory).
Step 3: Run the scan
python <path-to-scan.py> <target> --out .reports/warden-latest.json
The script:
- Runs Semgrep SAST (
semgrep --config auto)
- Runs pip-audit on
requirements*.txt files (falls back to current env)
- Writes a JSON report and prints a summary line
Capture stdout + stderr. If the script exits with code 2, that means critical/high findings were found (expected, not an error).
Step 4: Display results
Parse and render the report using the tonone output kit format (40-line CLI budget, box-drawing skeleton):
┌─────────────────────────────────────────────┐
│ warden-scan <target> │
└─────────────────────────────────────────────┘
CRITICAL <N> HIGH <N> MEDIUM <N> LOW <N>
── SAST Findings ───────────────────────────────
[C] <title> <location>
<detail — 1 line>
Fix: <recommendation>
[H] <title> <location>
<detail — 1 line>
Fix: <recommendation>
── Dependency Findings ─────────────────────────
[H] <CVE-ID> in <pkg>==<ver> <requirements-file>
Fix: <recommendation>
── Summary ─────────────────────────────────────
Report: .reports/warden-latest.json
Severity indicators: [C] critical, [H] high, [M] medium, [L] low.
Show all CRITICAL and HIGH findings. Collapse MEDIUM/LOW into a count if there are more than 5.
If 0 findings: show a clean pass banner.
Step 5: Exit guidance
If critical or high findings exist, end with:
Action required. Review findings above. Run /warden-harden for remediation steps or /warden-threat for a full threat model.
If only medium/low:
Passed with warnings. No critical issues found. Consider /warden-audit for a broader manual review.
If clean:
Clean scan. No issues found by Semgrep or pip-audit.
Follow the output format defined in docs/output-kit.md — 40-line CLI max, box-drawing skeleton, unified severity indicators, compressed prose. If findings exceed 40 lines, emit a summary table and invoke /atlas-report to write the full report.
