Skip to main content
vuln-patterns-core Universal vulnerability detection patterns applicable across all programming languages. Includes hardcoded secrets, SQL/command injection, path traversal, and configuration file patterns.
Jump to install Skills Marketplace Discover and explore AI skills built by the community.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Show prompt details A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/Zate/cc-plugins --skill vuln-patterns-coreThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Download Zip Downloading... More from this repository name vuln-patterns-core description Universal vulnerability detection patterns applicable across all programming languages. Includes hardcoded secrets, SQL/command injection, path traversal, and configuration file patterns.
Vulnerability Patterns: Core
Universal security patterns applicable to all programming languages.
When to Use This Skill
Live security hooks - Real-time validation of code changesCross-language scanning - Patterns that work on any codebaseConfiguration audits - Scanning env files, Docker, YAML configs
When NOT to Use This Skill
Language-specific patterns - Use vuln-patterns-languages skillFull security audits - Use domain auditor agentsRemediation guidance - Use remediation-* skills
Hardcoded Secrets
Detection Pattern :
# API Keys
(?i)(api[_-]?key|apikey)\s*[:=]\s*['"][a-zA-Z0-9]{16,}['"]
# AWS Keys
(?:AKIA|ABIA|ACCA|ASIA)[A-Z0-9]{16}
# Private Keys
-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----
# Generic Secrets
(?i)(password|secret|token|credential)s?\s*[:=]\s*['"][^'"]{8,}['"]
# JWT Secrets
(?i)(jwt[_-]?secret|signing[_-]?key)\s*[:=]\s*['"][^'"]+['"]
Grep Commands :
grep -rn --include="*.{js,ts,py,java,go,rb}" -E "(api[_-]?key|apikey)\s*[:=]\s*['\"][a-zA-Z0-9]{16,}['\"]" .
grep -rn -E "AKIA[A-Z0-9]{16}" .
grep -rn "BEGIN.*PRIVATE KEY" .
"*.{js,ts,py,java,go,rb}"
"(password|secret)\s*[:=]\s*['\"][^'\"]{8,}['\"]"
Severity : High
ASVS : V13.3.1 - Secrets not in version control
CWE : CWE-798 (Hardcoded Credentials)
SQL Injection # String concatenation in queries
(?i)(SELECT|INSERT|UPDATE|DELETE|FROM|WHERE).*\+\s*[a-zA-Z_]+
# f-string/template queries
(?i)f['"](SELECT|INSERT|UPDATE|DELETE).*\{
# Format string queries
(?i)(SELECT|INSERT|UPDATE|DELETE).*%\s*\(
# String interpolation
(?i)(SELECT|INSERT|UPDATE|DELETE).*\$\{
grep -rn --include="*.py" -E "f['\"]SELECT.*\{|f['\"]INSERT.*\{|f['\"]UPDATE.*\{|f['\"]DELETE.*\{" .
grep -rn --include="*.{js,ts}" -E "\`SELECT.*\$\{|\`INSERT.*\$\{|\`UPDATE.*\$\{|\`DELETE.*\$\{" .
grep -rn -E "(SELECT|INSERT|UPDATE|DELETE).*\+.*\+" .
Severity : Critical
ASVS : V1.2.1 - Parameterized queries
CWE : CWE-89 (SQL Injection)
Command Injection # Shell execution with variables
(?i)(os\.system|subprocess\.call|exec|shell_exec|system)\s*\([^)]*\+
(?i)(os\.system|subprocess\.call|exec|shell_exec|system)\s*\([^)]*\$\{
(?i)(os\.system|subprocess\.call|exec|shell_exec|system)\s*\([^)]*f['"]
# Dangerous shell=True
subprocess\.[a-z]+\([^)]*shell\s*=\s*True
grep -rn --include="*.py" -E "os\.system\s*\(.*\+" .
grep -rn --include="*.py" "shell\s*=\s*True" .
grep -rn --include="*.{js,ts}" -E "exec\s*\(.*\+" .
grep -rn --include="*.php" -E "(system|exec|shell_exec|passthru)\s*\(" .
Severity : Critical
ASVS : V1.2.3 - OS command injection prevention
CWE : CWE-78 (OS Command Injection)
Path Traversal # Direct path concatenation
(?i)(open|read|write|file|path)\s*\([^)]*\+.*\)
(?i)(open|read|write|file|path)\s*\([^)]*\$\{.*\)
# No path validation
os\.path\.join\s*\([^)]*,[^)]*\)(?!.*resolve|.*is_relative)
grep -rn --include="*.py" -E "open\s*\(.*\+" .
grep -rn --include="*.{js,ts}" -E "(readFile|writeFile|createReadStream)\s*\(.*\+" .
grep -rn --include="*.py" "os\.path\.join" . | grep -v "resolve\|is_relative"
Severity : High
ASVS : V5.4.1 - Path traversal prevention
CWE : CWE-22 (Path Traversal)
Configuration File Patterns
.env Files # Sensitive keys in .env
(?i)(password|secret|token|api[_-]?key|private[_-]?key)\s*=\s*[^\s]+
grep -rn -E "(?i)(password|secret|token|api.?key)=" .env * 2>/dev/null
Severity : High
ASVS : V13.3.1 - Secrets management
CWE : CWE-798 (Hardcoded Credentials)
Docker/Container # Privileged mode
--privileged
privileged:\s*true
# Running as root
USER\s+root
# Exposed secrets
ENV\s+(PASSWORD|SECRET|API_KEY|TOKEN)\s*=
grep -rn "privileged" Dockerfile docker-compose.yml 2>/dev/null
grep -rn "USER root" Dockerfile 2>/dev/null
grep -rn -E "ENV.*(PASSWORD|SECRET|API_KEY)" Dockerfile 2>/dev/null
Severity : High
ASVS : V13.2.1 - Secure configuration
CWE : CWE-250 (Excessive Privilege)
Quick Scan Script Use this script for rapid vulnerability detection:
#!/bin/bash
echo "=== Quick Security Scan ==="
echo -e "\n[1] Hardcoded Secrets"
grep -rn --include="*.{js,ts,py,java,go,rb,php}" -E "(api[_-]?key|password|secret)\s*[:=]\s*['\"][^'\"]{8,}['\"]" . 2>/dev/null | head -20
echo -e "\n[2] SQL Injection Patterns"
grep -rn --include="*.{js,ts,py,java,go,rb,php}" -E "(SELECT|INSERT|UPDATE|DELETE).*\+" . 2>/dev/null | head -20
echo -e "\n[3] Command Injection"
grep -rn --include="*.py" "shell\s*=\s*True" . 2>/dev/null
grep -rn --include="*.{js,ts}" -E "exec\s*\(|spawn\s*\(" . 2>/dev/null | head -10
echo -e "\n[4] Unsafe Deserialization"
grep -rn --include="*.py" "pickle\.load\|yaml\.load" . 2>/dev/null
grep -rn --include="*.java" "ObjectInputStream\|readObject" . 2>/dev/null
echo -e "\n[5] Weak Cryptography"
grep -rn --include="*.{py,java,go}" -E "md5|sha1|DES|RC4" . 2>/dev/null | head -10
echo -e "\n[6] Debug/Dev Settings"
grep -rn --include="*.py" "DEBUG\s*=\s*True" . 2>/dev/null
grep -rn "NODE_ENV.*development" . 2>/dev/null
echo -e "\n=== Scan Complete ==="
Integration with Live Hooks When using these patterns in PreToolUse hooks:
Parse the file content from the tool inputApply relevant patterns based on file extensionReturn blocking result for Critical/High severity matchesReturn warning for Medium severity matches
Pattern Matching Priority Severity Action Response Time Critical Block Immediate High Block/Warn Immediate Medium Warn Deferred Low Log Async
False Positive Mitigation
Context awareness : Check surrounding code for sanitizationAllowlists : Skip known-safe patterns (e.g., test files)Confidence scoring : Multiple indicators increase confidenceUser overrides : Allow explicit bypass with comments
See Also
vuln-patterns-languages - Language-specific patternsremediation-injection - SQL/command injection fixesremediation-auth - Secrets management fixes Related occupations SOC
Based on SOC occupation classification
