vulnerability-scan

name	vulnerability-scan
description	Scan source code for security vulnerabilities following OWASP methodology

Vulnerability Scan

When to Use

Use this skill when tasked with security review, before deploying code, or when auditing an unfamiliar codebase.

Severity Ratings

Severity	Definition	Examples
Critical	Exploitable now, data loss or system compromise	Hardcoded credentials, SQL injection, RCE
High	Likely exploitable, significant impact	Path traversal, missing auth on sensitive endpoint
Medium	Exploitable under certain conditions	Verbose error messages, weak crypto, SSRF
Low	Minor risk, defense in depth	Missing rate limiting, overly broad CORS
Info	Not exploitable but worth noting	Deprecated function usage, missing security headers

Finding Output Format

For each finding, produce:

### [SEVERITY] [Short title]
- **Location:** [file:line]
- **Description:** [What the vulnerability is]
- **Risk:** [What an attacker could do]
- **Evidence:** [The specific code or pattern found]
- **Remediation:** [How to fix it]

Procedure

1. Secrets and Credentials

Scan for hardcoded secrets, API keys, tokens, and passwords:

TARGET="${1:-~/workspace}"

echo "=== Scanning for secrets and credentials ==="

# API keys and tokens
rg -n -i '(api[_-]?key|apikey)\s*[:=]' "$TARGET" --type-add 'code:*.{js,py,ts,sh,json,yaml,yml,toml,env}' --type code

# Passwords
rg -n -i '(password|passwd|pwd)\s*[:=]\s*["\x27][^"\x27]' "$TARGET" --type-add 'code:*.{js,py,ts,sh,json,yaml,yml,toml,env}' --type code

# Generic secrets
rg -n -i '(secret|private[_-]?key)\s*[:=]\s*["\x27]' "$TARGET" --type-add 'code:*.{js,py,ts,sh,json,yaml,yml,toml,env}' --type code

# Known token formats
rg -n '(sk-[a-zA-Z0-9]{20,}|ghp_[a-zA-Z0-9]{36}|AKIA[A-Z0-9]{16}|xox[bpas]-[a-zA-Z0-9-]+)' "$TARGET"

# .env files that should not be committed
find "$TARGET" -name '.env' -not -path '*node_modules*' -not -path '*/.git/*' 2>/dev/null

2. Injection Risks

Scan for code injection, SQL injection, and command injection:

echo "=== Scanning for injection risks ==="

# SQL injection — string concatenation in queries
rg -n '(query|execute|sql)\s*\(.*\+.*\)' "$TARGET" --type-add 'code:*.{js,py,ts}' --type code
rg -n 'SELECT.*\+|INSERT.*\+|UPDATE.*\+|DELETE.*\+' "$TARGET" --type-add 'code:*.{js,py,ts}' --type code
rg -n "f['\"].*SELECT|f['\"].*INSERT|f['\"].*UPDATE|f['\"].*DELETE" "$TARGET" --type py

# Command injection — user input in exec/system calls
rg -n '(exec|execSync|spawn|system|popen|subprocess)\s*\(' "$TARGET" --type-add 'code:*.{js,py,ts}' --type code
rg -n 'child_process' "$TARGET" --type js
rg -n 'os\.system|subprocess\.call|subprocess\.run' "$TARGET" --type py

# eval() usage
rg -n '\beval\s*\(' "$TARGET" --type-add 'code:*.{js,py,ts}' --type code

# Path traversal — user input in file paths
rg -n '(readFile|writeFile|open|readdir)\s*\(.*req\.' "$TARGET" --type-add 'code:*.{js,ts}' --type code
rg -n 'open\s*\(.*request\.' "$TARGET" --type py
rg -n '\.\.\/' "$TARGET" --type-add 'code:*.{js,py,ts}' --type code | grep -v node_modules | grep -v '.git'

3. Authentication and Authorization

echo "=== Scanning for auth issues ==="

# Endpoints without auth middleware
rg -n '(app\.(get|post|put|delete|patch)|router\.(get|post|put|delete|patch))' "$TARGET" --type-add 'code:*.{js,ts}' --type code | head -20

# Default credentials
rg -n -i '(admin|root|test|demo|default).*password' "$TARGET" --type-add 'code:*.{js,py,ts,json,yaml,yml}' --type code

# Missing rate limiting
rg -n 'rate.?limit' "$TARGET" --type-add 'code:*.{js,py,ts}' --type code
echo "(If no results above, rate limiting may be missing)"

# JWT issues
rg -n 'algorithm.*none|verify.*false|expiresIn.*[0-9]{5,}' "$TARGET" --type-add 'code:*.{js,py,ts}' --type code

4. Data Exposure

echo "=== Scanning for data exposure ==="

# Sensitive data in logs
rg -n '(console\.log|print|logging\.(info|debug)).*\b(password|token|secret|key|ssn|credit)\b' \
  "$TARGET" --type-add 'code:*.{js,py,ts}' --type code -i

# Verbose error messages in responses
rg -n '(res\.send|res\.json|return.*Response).*\b(stack|trace|error\.message)\b' \
  "$TARGET" --type-add 'code:*.{js,py,ts}' --type code

# Debug mode in production configs
rg -n '(DEBUG\s*=\s*[Tt]rue|debug:\s*true|NODE_ENV.*development)' \
  "$TARGET" --type-add 'code:*.{js,py,ts,json,yaml,yml,env}' --type code

5. Dependency Vulnerabilities

echo "=== Scanning for dependency vulnerabilities ==="

# npm audit
if [ -f "$TARGET/package.json" ]; then
  cd "$TARGET"
  npm audit --json 2>/dev/null | jq '{
    total: .metadata.vulnerabilities,
    critical: [.vulnerabilities | to_entries[] | select(.value.severity == "critical") | .key],
    high: [.vulnerabilities | to_entries[] | select(.value.severity == "high") | .key]
  }' 2>/dev/null || npm audit 2>&1 | tail -20
fi

# pip audit
if [ -f "$TARGET/requirements.txt" ]; then
  cd "$TARGET"
  pip audit 2>&1 | tail -20 || echo "pip-audit not available — install with: pip install pip-audit"
fi

6. Compile Report

REPORT_FILE="/home/shared/security-scan-$(date +%Y%m%d).md"

cat > "$REPORT_FILE" <<'EOF'
# Security Scan Report

**Date:** YYYY-MM-DD
**Target:** [path]
**Scanner:** [agent name]

## Summary
| Severity | Count |
|----------|-------|
| Critical | 0 |
| High | 0 |
| Medium | 0 |
| Low | 0 |
| Info | 0 |

## Findings

### [SEVERITY] [Title]
- **Location:** file:line
- **Description:** ...
- **Risk:** ...
- **Evidence:** `code snippet`
- **Remediation:** ...

## Clean Areas
- [Areas scanned with no findings — confirms coverage]

## Scan Limitations
- [What was NOT covered and why]
EOF

# Register as artifact
bash /home/shared/scripts/artifact.sh register \
  --name "security-scan" \
  --type "report" \
  --path "$REPORT_FILE" \
  --description "Security vulnerability scan report"

Quality Checklist

• All five categories scanned (secrets, injection, auth, data exposure, dependencies)
• Every finding has severity, location, description, risk, and remediation
• No false positives included without noting they need manual verification
• Clean areas documented to show scan coverage
• Limitations explicitly stated (e.g., "no dynamic analysis performed")
• Report written to shared workspace and registered as artifact