security-scan

name	security-scan
description	Comprehensive security scanning for code, dependencies, and infrastructure. Detects vulnerabilities, misconfigurations, and security risks.
triggers	["security scan","漏洞扫描","vulnerability scan","security audit"]

Security Scan

Comprehensive security scanning and vulnerability detection.

Features

• 🔍 Code Scan — Static analysis for security issues
• 📦 Dependency Scan — Check for vulnerable packages
• 🌐 Infrastructure Scan — Cloud/Docker security
• 🔑 Secret Scan — Detect exposed credentials
• 📊 Compliance — SOC2, HIPAA, GDPR checks

Usage

Scan Project

# Full scan
hermes security scan /path/to/project

# Fast scan
hermes security scan /path/to/project --mode fast

# Specific checks
hermes security scan --checks secrets,vulns,configs

Dependency Scan

# Scan dependencies
hermes security deps --file package-lock.json

# Python packages
hermes security deps --file requirements.txt

# Docker images
hermes security scan-image node:18-alpine

Secret Detection

# Scan for secrets
hermes security secrets --path ./src/

# Git history
hermes security secrets --git-history

Report

# Generate report
hermes security report --format html --output security-report.html

# Severity filter
hermes security report --severity critical,high

Configuration

# security-config.yml
scan:
  exclude: ["node_modules", ".git", "test/**"]
  severity_threshold: medium
  
secrets:
  patterns:
    - "api[_-]?key"
    - "password"
    - "secret"
    
dependencies:
  ignore: ["dev-only-pkg"]

Pitfalls

1. False Positives — Always verify reported issues
2. Performance — Full scans can be slow on large codebases
3. Credentials — Don't commit API keys to scanner