Menu
Run security scans against the codebase.
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/coreindustries/core-ai-template --skill scanThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Based on SOC occupation classification
Showing SKILL.md
| name | scan |
| description | Run security scans against the codebase. |
Run security scans against the codebase.
/security-scan [target] [--deps] [--code] [--secrets] [--all]
target: Specific file or directory (default: entire project)--deps: Scan dependencies only--code: Scan code only--secrets: Scan for secrets only--all: Run all scans (default)When this skill is invoked:
Autonomy:
Thoroughness:
.claude/rules/security*.md guidelinesRead prd/00_technology.md for security tools
Review .claude/rules/security*.md for security standards
Run dependency scan:
# Tool depends on your stack (see prd/00_technology.md)
{dependency_scan_command}
Run static code analysis:
{security_scan_command} src/
(gitleaks):
# Full repo scan
scripts/scan-secrets.sh --all
# Or directly:
gitleaks detect --config .gitleaks.toml --verbose
Categorize findings by severity:
Generate report
## Security Scan Report
**Scan Date:** {date}
**Overall Score:** {score}/100
---
### Summary
| Severity | Count |
|----------|-------|
| Critical | 0 |
| High | 1 |
| Medium | 2 |
| Low | 3 |
| Info | 5 |
---
### Dependency Vulnerabilities
#### High Severity
1. **CVE-2024-XXXX** in `package@1.2.3`
- Impact: Remote code execution
- Fix: Upgrade to 1.2.4+
- File: package.json:15
---
### Code Security Issues
#### Medium Severity
1. **SQL Injection Risk** (`src/{project}/db/queries:45`)
query = f"SELECT * FROM users WHERE id = {user_id}"
query = "SELECT * FROM users WHERE id = ?"
---
### Secrets Detected
#### High Severity
1. **Potential API Key** (`src/{project}/config:23`)
- Pattern: `API_KEY = "sk-..."`
- Fix: Move to environment variable
---
### PII Detected
#### High Severity
1. **US Social Security Number** (`src/{project}/utils:78`)
- Pattern: `ssn = "123-45-6789"`
- Fix: Remove hardcoded PII, use encrypted storage
2. **Credit Card Number** (`src/{project}/payments:34`)
- Pattern: `card = "4111-1111-1111-1111"`
- Fix: Use tokenized payment processing
---
### Recommendations
1. **Immediate**: Upgrade {package} to fix CVE-XXXX
2. **High Priority**: Move hardcoded secrets to .env
3. **Medium Priority**: Fix SQL injection in queries
From .claude/rules-available/security-owasp.md:
| Category | Check |
|---|---|
| A01 - Broken Access Control | Auth on all protected routes |
| A02 - Cryptographic Failures | Modern algorithms, no hardcoded secrets |
| A03 - Injection | Parameterized queries, input validation |
| A04 - Insecure Design | Security headers, rate limiting |
| A05 - Security Misconfiguration | No debug in prod, secure defaults |
| A06 - Vulnerable Components | Up-to-date dependencies |
| A07 - Auth Failures | Strong passwords, MFA, session management |
| A08 - Integrity Failures | Safe deserialization, signed packages |
| A09 - Logging Failures | Security event logging |
| A10 - SSRF | URL validation, IP filtering |
$ /scan
๐ Running security scans...
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
๐ฆ Dependency Scan
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
Found 2 vulnerabilities:
๐ด High: CVE-2024-1234 in requests@2.25.0
๐ก Medium: CVE-2024-5678 in yaml@5.3.0
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
๐ Code Analysis
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
Found 1 issue:
๐ก Medium: Potential SQL injection (src/db/queries:45)
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
๐ Secrets & PII Detection (gitleaks)
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ
No secrets or PII detected
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
๐ Security Score: 78/100
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
Recommendations:
1. Upgrade requests to 2.28.0+
2. Upgrade yaml to 6.0.0+
3. Fix SQL injection in src/db/queries:45