cs-security

Estrelas15

Forks1

Atualizado29 de março de 2026 às 02:13

Full security audit: detect local vulnerabilities, cross-file taint flows, CVEs in dependencies, and polyglot sink patterns. Complete security scan pipeline.

Instalação

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Fonte

3D-Tech-Solutions

3D-Tech-Solutions/code-scalpel

Abrir repositório GitHub Ver repositórios do creator

Download

Ocupações relacionadasSOC

Baseado na classificação ocupacional SOC

Analistas de segurança da informaçãoInformática e Matemática·SOC 15-1212

SKILL.md

readonly

name	cs-security
description	Full security audit: detect local vulnerabilities, cross-file taint flows, CVEs in dependencies, and polyglot sink patterns. Complete security scan pipeline.
allowed-tools	["mcp__codescalpel__security_scan","mcp__codescalpel__cross_file_security_scan","mcp__codescalpel__unified_sink_detect","mcp__codescalpel__scan_dependencies"]
preamble-tier	1

/cs-security — Full Security Audit

Run a complete security analysis: find SQL injection, XSS, command injection, path traversal, tainted data flows, and vulnerable dependencies.

Usage

/cs-security
/cs-security src/api/

The Full Pipeline

Local analysis — Detect SQL injection, XSS, command injection, path traversal within files
- Taint analysis traces user input → dangerous functions
- Confidence threshold: 70% minimum
Cross-file analysis — Find vulnerabilities that span module boundaries
- Taint flows across function calls
- Identifies where untrusted data enters your system
Dependency scan — Check for known CVEs in your libraries
- Uses OSV (Open Source Vulnerabilities) database
- Shows version constraints to fix
Polyglot detection — Find sinks across Python, JavaScript, TypeScript, Java
- Frontend-backend vulnerability patterns
- TypeScript type-safety issues at system boundaries

Vulnerability Types Detected

SQL Injection — Raw SQL with user input
XSS — Unescaped output to HTML/DOM
Command Injection — User input to shell commands
Path Traversal — User input to file paths without validation
Tainted Data Flows — Untrusted data reaching sensitive functions
Type Erosion — JavaScript/TypeScript type safety breakdowns

Interpreting Results

HIGH confidence — Almost certainly a real vulnerability, fix immediately
MEDIUM confidence — Likely a vulnerability, investigate and validate
LOW confidence — Possible false positive, review code context

What Happens Next

Read the vulnerability report
Use /cs-extract to see the vulnerable code
Use /cs-refactor to fix it safely
Re-run /cs-security to confirm the fix

Pro Tip

Run this on your whole project regularly:

/cs-security .

See CLAUDE.md for the complete security workflow.

Mais deste repositório

mesmo repositório

cs-analyze

3D-Tech-Solutions/code-scalpel

Analyze code structure: parse functions, classes, imports, and complexity metrics. Use to understand a file or project without reading the source code directly.

2026-03-2915

cs-extract

3D-Tech-Solutions/code-scalpel

Extract a specific function, class, or method from a file using Code Scalpel. Use when you need to show a symbol without reading the entire file—saves 95% of context.

2026-03-2915

cs-map

3D-Tech-Solutions/code-scalpel

Map project architecture: discover modules, build call graphs, visualize structure, trace critical paths. Complete architecture overview with dependency flows.

2026-03-2915

cs-policy

3D-Tech-Solutions/code-scalpel

Verify code compliance with policies and standards: HIPAA, SOC2, PCI-DSS, custom style guides. Validate policy file integrity with cryptographic verification.

2026-03-2915

cs-refactor

3D-Tech-Solutions/code-scalpel

Safe refactoring workflow: find all usages, trace dependencies, simulate changes, generate baseline tests, then apply with backup. Behavior-preserving refactor.

2026-03-2915

cs-setup

3D-Tech-Solutions/code-scalpel

Install and verify the Code Scalpel MCP server. Checks if codescalpel is already installed in Claude Code, runs `claude mcp add` if needed, and confirms connection by fetching capabilities.

2026-03-2915

/cs-security — Full Security Audit

Run a complete security analysis: find SQL injection, XSS, command injection, path traversal, tainted data flows, and vulnerable dependencies.

Usage

/cs-security /cs-security src/api/

The Full Pipeline

Local analysis — Detect SQL injection, XSS, command injection, path traversal within files

Taint analysis traces user input → dangerous functions
Confidence threshold: 70% minimum

Cross-file analysis — Find vulnerabilities that span module boundaries

Taint flows across function calls
Identifies where untrusted data enters your system

Dependency scan — Check for known CVEs in your libraries

Uses OSV (Open Source Vulnerabilities) database
Shows version constraints to fix

Polyglot detection — Find sinks across Python, JavaScript, TypeScript, Java

Frontend-backend vulnerability patterns
TypeScript type-safety issues at system boundaries

Vulnerability Types Detected

SQL Injection — Raw SQL with user input

XSS — Unescaped output to HTML/DOM

Command Injection — User input to shell commands

Path Traversal — User input to file paths without validation

Tainted Data Flows — Untrusted data reaching sensitive functions

Type Erosion — JavaScript/TypeScript type safety breakdowns

Interpreting Results

HIGH confidence — Almost certainly a real vulnerability, fix immediately

MEDIUM confidence — Likely a vulnerability, investigate and validate

LOW confidence — Possible false positive, review code context

What Happens Next

Read the vulnerability report

Use /cs-extract to see the vulnerable code

Use /cs-refactor to fix it safely

Re-run /cs-security to confirm the fix

Pro Tip

Run this on your whole project regularly:

/cs-security .

See CLAUDE.md for the complete security workflow.