ak-security-scan

name	ak:security-scan
description	Scan codebase for security vulnerabilities, hardcoded secrets, dependency issues, and OWASP patterns. Use when asked to 'security scan', 'check for secrets', 'audit security', or before major releases.
user-invocable	true
when_to_use	Invoke for secrets, dependency, and OWASP-style scans.
category	utilities
keywords	["security","secrets","vulnerabilities","OWASP"]
argument-hint	[scope] [--secrets-only] [--deps-only] [--full]
metadata	{"author":"agentkit","version":"1.0.0"}

Security Scan

Lightweight security scanner using Claude's reasoning + shell tools. No external dependencies required.

Usage

/ak:security-scan              # Full scan of current project
/ak:security-scan --secrets-only   # Only secret/credential detection
/ak:security-scan --deps-only      # Only dependency audit
/ak:security-scan src/api/         # Scan specific directory

Scan Categories

Category	Method	Speed	Reference
Secrets	search_files capability regex patterns	Fast	references/secret-patterns.md
Dependencies	npm audit / pip audit	Medium	Built-in
Code patterns	search_files capability + Claude analysis	Medium	references/vulnerability-patterns.md

Workflow

1. Detect Project Type

- Check for package.json → Node.js
- Check for requirements.txt / pyproject.toml → Python
- Check for go.mod → Go
- Check for Cargo.toml → Rust

2. Secret Scanning (Always runs first)

Load references/secret-patterns.md for regex patterns.

Use search_files capability to search for each pattern category:

• API keys and tokens (AWS, GitHub, Stripe, etc.)
• Private keys and certificates
• Database connection strings with credentials
• Hardcoded passwords in code

Exclude: .env.example, test fixtures, documentation, node_modules/, dist/

For each match:

• Verify it's a real secret (not a placeholder like YOUR_API_KEY)
• Rate severity: CRITICAL (exposed prod key), HIGH (real credential), MEDIUM (possible credential)

3. Dependency Audit (If applicable)

Run the appropriate command:

# Node.js
npm audit --json 2>/dev/null || echo '{"error":"npm audit failed"}'

# Python (if pip-audit available)
pip audit --format json 2>/dev/null ||