| name | guardian-security |
| description | Scan project files for likely hardcoded secrets and inspect container images for HIGH or CRITICAL CVEs with Trivy. Use for local security audits before commits, releases, or deployments; treat findings as heuristics requiring review. |
Guardian Security
Local security auditing for credentials and container vulnerabilities.
Core Workflows
1. Secret Scanning
Scan specific project directories for hardcoded credentials.
- Tool:
scripts/scan_secrets.py
- Usage:
python3 $WORKSPACE/skills/guardian-security/scripts/scan_secrets.py <path_to_project>
- Workflow:
- Execute scan on a specific project or directory.
- If findings are reported (exit code 1):
- Review the file and line number.
- Transition: Move the secret to a secure vault (e.g., using the
mema-vault skill).
- Redact: Replace the plaintext secret in the source code with an environment variable or a vault lookup call.
2. Container Vulnerability Scan
Analyze Docker images for vulnerabilities prior to deployment.
- Tool:
scripts/scan_container.sh
- Usage:
bash $WORKSPACE/skills/guardian-security/scripts/scan_container.sh <image_name>
- Logic: Identify
HIGH and CRITICAL severities. Recommend base image updates or security patches.
Security Guardrails
- Scope Limitation: Avoid scanning system-level directories. Focus only on relevant project workspaces.
- Credential Isolation: Hardcoded secrets are considered a high-severity finding.
- Output Safety: Report locations and secret types only; never print matched secret values.
- Failure Handling: Treat scanner errors and unreadable inputs as incomplete audits, not clean results.
- Dependencies: Container scanning requires
trivy to be installed on the host system.
Integration
- Vaulting: This skill identifies leaks. Remediation should be performed using a dedicated credential manager like
mema-vault.