sec-check

Use first-pass security scan on unknown/mixed-language codebases, secrets detection (API keys, passwords, tokens), malicious pattern detection (reverse shells, data exfiltration, obfuscation). (2) SECONDARY use supplement language-specific tools with 'secrets' and 'exec' database scans. Key databases secrets (credentials), exec (command injection), sql, xss, plus language-specific. Use for a lightweight Static Application Security Testing (SAST) and rapid source code auditing to identify "sinks" and dangerous functions that could lead to exploits like SQL injection, XSS, and buffer overflows. It is ideal for broad, multi-language security checks. This skill supports auditing for TypeScript, JavaScript, Python, C/C++, Go, Java, .NET/C#, Perl, PHP, Ruby, and SQL. Do NOT use as sole scanner when bandit (Python .py files) or shellcheck (shell .sh files) are applicable—use graudit alongside then.

Comprehensive security scanner for container images, filesystems, Git repositories, Kubernetes, and IaC. (1) Detects known vulnerabilities (CVEs) in OS packages and dependencies. (2) Scans for IaC misconfigurations (Terraform, CloudFormation, Helm, Kubernetes YAML). (3) Detects hardcoded secrets (API keys, passwords, tokens). (4) Identifies license compliance issues. Use for container security, cloud-native security, DevSecOps pipelines, pre-deployment scans. Targets: Docker images, filesystem directories, remote Git repos, Kubernetes clusters, SBOM files. Do NOT use for Python source code vulnerabilities (use bandit), shell script issues (use shellcheck), or malicious package detection (use guarddog).

Security analysis of JavaScript/TypeScript code (.js, .jsx, .ts, .tsx) for vulnerabilities using ESLint with security plugins. (1) Detects code injection (eval, Function), XSS (innerHTML, dangerouslySetInnerHTML), command injection (child_process), ReDoS, path traversal, insecure crypto, prototype pollution. Use for web apps, Node.js services, React/Vue/Angular projects, npm packages, malicious code triage. NOT use for dependency CVEs (use npm audit), non-JavaScript code (use language-specific tools), minified code. For full coverage combine with npm audit or OWASP Dependency-Check for supply chain security.

Scan Infrastructure as Code (IaC) for security misconfigurations and compliance violations using Checkov. (1) Primary use for Terraform, CloudFormation, Kubernetes manifests, Dockerfiles, Helm charts, ARM/Bicep templates, GitHub Actions, GitLab CI, and CI/CD pipelines. (2) Detects cloud misconfigurations, exposed secrets, overly permissive IAM policies, unencrypted storage, public access risks, container security issues. (3) Use for IaC security audits, compliance scanning (CIS, SOC2, HIPAA, PCI-DSS), pre-deployment validation, CI/CD security gates. Do NOT use for application source code vulnerabilities (use bandit, graudit) or dependency/package audits (use guarddog, dependency-check).

Scan project dependencies for known vulnerabilities (CVEs) using OWASP Dependency-Check. (1) Primary use for Software Composition Analysis (SCA) of Java (.jar, .war, .ear), .NET (.dll, .exe, .nupkg), JavaScript (package.json, .js), Python (requirements.txt), Ruby (Gemfile.lock), and Go (go.mod) projects. (2) Detects CVEs from NVD, CISA KEV, OSS Index, RetireJS. (3) Use for dependency audits, CI/CD security gates, compliance scanning, supply chain risk assessment. Do NOT use for source code vulnerabilities (use bandit, graudit) or malicious package detection (use guarddog).

Security audit of Python source code (.py, setup.py, pyproject.toml) for security vulnerabilities using Bandit AST analysis. (1) Detects exec/eval code execution, pickle/yaml deserialization, subprocess shell injection, SQL injection, hardcoded credentials, weak cryptography, OWASP Top 10 Python issues. Use for Python security audits, Django/Flask apps, malicious Python code triage, CI/CD pipelines. NOT use for dependency/package audits (use guarddog), non-Python code (use graudit), shell scripts (use shellcheck). For mixed Python projects, combine with graudit -d secrets for comprehensive coverage.

Detect malicious packages and supply chain attacks in Python (PyPI) and Node.js (npm) ecosystems.ALWAYS use BEFORE running pip install or npm install on untrusted packages.(1) Primary targets requirements.txt, package.json, package-lock.json, *.tar.gz, *.tgz archives.(2) Detects malware, data exfiltration, reverse shells, backdoors, typosquatting, obfuscated payloads, compromised maintainer accounts.(3) Use for dependency audits, pre-installation checks, investigating suspicious packages, supply chain security. Do NOT use for scanning your own source code vulnerabilities (use bandit for Python, graudit for multi-language).

Scan shell scripts for security vulnerabilities using ShellCheck static analysis. Scan files *.sh, *.bash, shell code in Dockerfiles, .github/workflows/*.yml, Makefiles, npm scripts. (1) Detects command injection, arbitrary code execution, reverse shell patterns, data exfiltration, obfuscated payloads (base64/hex), unsafe rm operations, dangerous PATH manipulation. (2) Use for standalone scripts, CI/CD pipelines, installation scripts,build systems. For shell scripts containing embedded Python/other code, also run language-specific scanners. Combine with graudit -d exec for patterns ShellCheck may miss (e.g., base64 | bash).