security-scanning

name	security-scanning
description	Automated security scanning pipeline covering SAST (Semgrep), SCA (OWASP dependency-check), SBOM generation (Syft), vulnerability scanning (Grype), and secrets detection (detect-secrets). Invoked by security-architect for pre-commit gates, CI integration, and finding triage.
version	1.0.0
category	security
agents	["security-architect","devops","qa"]
tools	["Bash","Read","Write","Grep"]
source	builtin
trust_score	100
provenance_sha	c6195cf3c263847d

Security Scanning Skill

Automated security scanning pipeline: SAST, SCA, SBOM, and secrets detection.

Tools

Tool	Purpose	Install
Semgrep	SAST — static analysis	pip install semgrep
OWASP dependency-check	SCA — known CVEs in deps	brew install dependency-check
Syft	SBOM generation	brew install anchore/syft/syft
Grype	Vulnerability scanner (uses SBOM)	brew install anchore/grype/grype
detect-secrets	Secrets detection	pip install detect-secrets

Phase 1: SAST — Static Analysis (Semgrep)

# Run default ruleset
semgrep --config auto .

# Run security-focused rules only
semgrep --config p/security-audit .

# Run OWASP Top 10 rules
semgrep --config p/owasp-top-ten .

# Output JSON for CI
semgrep --config auto --json --output semgrep-results.json .

# Fail CI on any HIGH or CRITICAL finding
semgrep --config auto --severity ERROR .

Recommended rulesets:

• p/security-audit — broad security audit
• p/owasp-top-ten — OWASP Top 10 coverage
• p/javascript — JS/TS patterns (injection, XSS, prototype pollution)
• p/python — Python patterns (SQL injection, insecure deserialization)
• p/secrets — hardcoded credential detection

Phase 2: SCA — Software Composition Analysis (OWASP dependency-check)

# Scan Node.js project
dependency-check --project myapp --scan . --format JSON --out dependency-check-report

# Scan with NVD API key (avoids rate limiting)
dependency-check --project myapp --scan . \
  --nvdApiKey "$NVD_API_KEY" \
  --format HTML --out reports/

# CI integration: fail on CVSS >= 7.0
dependency-check --project myapp --scan . \
  --failOnCVSS 7 \
  --format JSON --out reports/


dependency-check --project myapp --scan . \
  --suppression suppressions.xml