security-scanning-patterns

name	Security Scanning Patterns
description	Security vulnerability scanning, secret detection, dependency auditing, and OWASP best practices. Use when performing security audits, scanning for vulnerabilities, detecting exposed secrets, checking dependencies, validating security headers, implementing OWASP patterns, or when user mentions security, vulnerabilities, secrets, CVE, OWASP, npm audit, security headers, or penetration testing.
allowed-tools	["Bash","Read","Write","Edit","Glob","Grep"]

Security Scanning Patterns

CRITICAL: The description field above controls when Claude auto-loads this skill.

Overview

Comprehensive security scanning capabilities including secret detection, dependency vulnerability scanning, OWASP Top 10 pattern detection, security header validation, and automated security reporting. Supports multiple languages (JavaScript, TypeScript, Python, Go, Rust, Java) and provides actionable remediation guidance.

Instructions

1. Secret Detection

Scan codebases for exposed credentials, API keys, tokens, and sensitive data:

Process:

1. Use bash scripts/scan-secrets.sh <target-directory> to scan for secrets
2. Reference templates/secret-patterns.json for comprehensive regex patterns
3. Check for AWS keys, GitHub tokens, API keys, passwords, private keys, certificates
4. Scan git history for previously committed secrets
5. Generate detailed findings with file paths and line numbers

Patterns Detected:

• AWS Access Keys (AKIA..., ASIA...)
• GitHub Personal Access Tokens (ghp_, gho_, ghs_)
• API Keys (generic patterns, vendor-specific)