loom-security-scan

name	loom-security-scan
description	Quick routine security checks for secrets, dependencies, container images, and common vulnerabilities. Use for lightweight pre-commit and CI scans with tools like Semgrep, Trivy, gitleaks, cargo audit, npm audit, and pip-audit. Not a substitute for deep audits (use loom-security-audit).
allowed-tools	["Read","Grep","Glob","Bash"]
triggers	["security scan","SAST","DAST","vulnerability scan","dependency scan","container scan","secret scan","credential scan","quick scan","secrets check","vulnerability check","security check","pre-commit security","routine security","Snyk","Trivy","Semgrep","CodeQL","Bandit","safety","npm audit","cargo audit","gitleaks","trufflehog","govulncheck","pip-audit"]

Security Scan

Overview

This skill provides quick, routine security checks that should be run frequently during development. These are lightweight scans designed to catch common issues early, not comprehensive audits.

Tool Selection Matrix

Scan Type	Best Tool	Alternative	Use Case
Secrets	TruffleHog	Gitleaks	Hardcoded credentials, API keys
Dependencies (JS)	npm audit	Snyk, OWASP	Known CVEs in packages
Dependencies (Python)	pip-audit	safety	PyPI vulnerability database
Dependencies (Go)	govulncheck	nancy	Official Go vuln DB
Dependencies (Rust)	cargo audit	-	RustSec Advisory DB
Container Images	Trivy	Grype, Snyk	Image vulnerabilities, secrets
SAST (Multi-lang)	Semgrep	CodeQL	Security anti-patterns
SAST (Python)	Bandit	Semgrep	Python-specific issues
SAST (Go)	gosec	Semgrep	Go-specific issues
Dockerfile	hadolint	Trivy config	Best practices, misconfig
IaC (Terraform)	tfsec	Checkov, Trivy	Terraform misconfigurations
IaC (K8s)	kubesec	Trivy, Checkov	Kubernetes YAML security

When to Use

• Before commits: Quick check for secrets and obvious issues
• During PR review: Verify no new vulnerabilities introduced
• Regular intervals: Daily/weekly automated checks
• After dependency updates: Verify no new CVEs
• Quick sanity checks: Fast verification during development

For comprehensive security work, use the loom-security-audit skill or escalate to the senior-software-engineer agent with /loom-security-audit and /loom-threat-model skills.

Quick Scan Checklist

Run these checks in order of priority:

1. Secret Detection (Critical)

Goal: Find hardcoded credentials, API keys, tokens, and private keys before they reach version control.

# Check for hardcoded secrets with grep patterns
# API keys
grep -rn --include="*.{js,ts,py,go,java,rb,php}" \
  -E "(api[_-]?key|apikey)\s*[:=]\s*['\"][a-zA-Z0-9]{16,}" .

# AWS credentials
grep -rn --include="*.{js,ts,py,go,java,rb,php,env,yaml,yml,json}" \
  -E "(AKIA|ABIA|ACCA|ASIA)[A-Z0-9]{16}" .

# Private keys
grep -rn --include="*.{pem,key,env}" \
  -E "-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----" .

# Generic secrets
grep -rn --include="*.{js,ts,py,go,java,rb,php}" \
  -E "(password|secret|token)\s*[:=]\s*['\"][^'\"]{8,}" .

Better: Use Dedicated Tools

# TruffleHog (recommended)
trufflehog filesystem --directory=. --only-verified --no-update

# GitLeaks
gitleaks detect --source=. --no-git

# git-secrets (if installed)
git secrets --scan

2. Dependency Vulnerabilities (High)

Goal: Identify known CVEs in direct and transitive dependencies across package ecosystems.

# Node.js
npm audit --audit-level=high
# or
yarn audit --level high

# Python
pip-audit
# or
safety check

# Go
govulncheck ./...

# Rust
cargo audit

# Ruby
bundle audit check --update

# .NET
dotnet list package --vulnerable --include-transitive

# Multi-ecosystem (Snyk - requires account)
snyk test --severity-threshold=high

# OWASP Dependency-Check (slow but comprehensive)
dependency-check --scan . --failOnCVSS 7

3. Container Image Scanning (High)

Goal: Scan Docker images for vulnerabilities, misconfigurations, and embedded secrets.

# Trivy (recommended - fast, comprehensive)
trivy image --severity HIGH,CRITICAL myimage:latest
trivy image --scanners vuln,secret,config myimage:latest

# Grype (Anchore)
grype myimage:latest --only-fixed

# Snyk Container
snyk container test myimage:latest --severity-threshold=high

# Docker Scout (Docker Desktop)
docker scout cves myimage:latest --only-severity critical,high

# Clair (requires server)
clairctl analyze myimage:latest

# Scan Dockerfile before building
hadolint Dockerfile
trivy config --severity HIGH,CRITICAL Dockerfile

4. Quick Static Analysis (Medium)

Goal: Detect security anti-patterns and common vulnerability classes with SAST tools.

# Multi-language with Semgrep (fast defaults)
semgrep --config=p/security-audit --config=p/secrets .

# Python only
bandit -r . -ll  # Only high severity

# JavaScript/TypeScript
npx eslint . --ext .js,.ts --no-eslintrc \
  --plugin security --rule 'security/detect-object-injection: error'

# Go
gosec -severity high ./...

# CodeQL (requires GitHub setup)
codeql database create codeql-db --language=javascript
codeql database analyze codeql-db --format=sarif-latest --output=results.sarif

# SonarQube (requires server)
sonar-scanner -Dsonar.projectKey=myproject

5. Configuration Checks (Medium)

Goal: Validate infrastructure-as-code and configuration files for security misconfigurations.

# Docker
hadolint Dockerfile

# Terraform
tfsec . --minimum-severity HIGH

# Kubernetes
kubesec scan deployment.yaml

# General config
checkov -f config.yaml --check HIGH

Pre-Commit Hook Setup

Add to .pre-commit-config.yaml:

repos:
  - repo: https://github.com/trufflesecurity/trufflehog
    rev: v3.63.0
    hooks:
      - id: trufflehog
        entry: trufflehog filesystem --no-update --fail --only-verified
        args: ["--directory=."]

  - repo: https://github.com/zricethezav/gitleaks
    rev: v8.18.0
    hooks:
      - id: gitleaks

  - repo: https://github.com/returntocorp/semgrep
    rev: v1.52.0
    hooks:
      - id: semgrep
        args: ["--config=p/secrets", "--error"]

Tool Installation Quick Reference

# Secret scanning
brew install trufflesecurity/trufflehog/trufflehog
brew install gitleaks

# Dependency scanning
npm install -g npm-audit
pip install pip-audit safety
go install golang.org/x/vuln/cmd/govulncheck@latest
cargo install cargo-audit

# Container scanning
brew install trivy
brew install anchore/grype/grype

# SAST
brew install semgrep
pip install bandit
go install github.com/securego/gosec/v2/cmd/gosec@latest

# Infrastructure scanning
brew install hadolint tfsec

CI/CD Integration

GitHub Actions (Recommended)

name: Security Scan

on:
  push:
    branches: [main]
  pull_request:

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Secret Scan
        uses: trufflesecurity/trufflehog@main
        with:
          extra_args: --only-verified

      - name: Dependency Scan
        run: |
          npm audit --audit-level=high || true
          # Add other package managers as needed

      - name: SAST
        uses: returntocorp/semgrep-action@v1
        with:
          config: p/security-audit p/secrets

      - name: Container Scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: myimage:${{ github.sha 
           
           

GitLab CI

security-scan:
  stage: test
  image: returntocorp/semgrep:latest
  script:
    - semgrep --config=p/security-audit --config=p/secrets .
  allow_failure: false

dependency-scan:
  stage: test
  image: node:latest
  script:
    - npm audit --audit-level=high
  allow_failure: false

container-scan:
  stage: test
  image: aquasec/trivy:latest
  script:
    - trivy image --severity HIGH,CRITICAL $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA

CircleCI

version: 2.1

orbs:
  security: circleci/security@1.0

workflows:
  security-checks:
    jobs:
      - security/scan:
          severity: high
      - trivy/scan:
          image: myimage:latest

Scan Result Interpretation

Severity Levels

Level	Action	Timeline
Critical	Block merge, fix immediately	Hours
High	Should fix before merge	Days
Medium	Plan to fix	Sprint
Low	Track, fix opportunistically	Backlog

Common False Positives

Secret Detection:

• Test fixtures with fake keys
• Documentation examples
• Base64-encoded non-secrets
• UUIDs and random IDs

Dependency Scans:

• Dev-only dependencies
• Unused code paths
• Already-mitigated issues

Triaging Results

## Scan Results Triage

### Confirmed Issues

| Finding           | Severity | File         | Action             |
| ----------------- | -------- | ------------ | ------------------ |
| Hardcoded API key | Critical | config.js:42 | Remove, rotate key |
| lodash CVE        | High     | package.json | Update to 4.17.21  |

### False Positives

| Finding            | Reason       | Action                 |
| ------------------ | ------------ | ---------------------- |
| test_api_key       | Test fixture | Add to .gitleaksignore |
| dev dependency CVE | Not in prod  | Document acceptance    |

### Accepted Risks

| Finding             | Justification     | Reviewer  |
| ------------------- | ----------------- | --------- |
| Low CVE in CLI tool | Internal use only | @security |

Quick Commands Reference

# One-liner: Quick secret + dependency check
npm audit --audit-level=high && gitleaks detect --no-git

# Python projects
pip-audit && bandit -r src/ -ll

# Go projects
govulncheck ./... && gosec -severity high ./...

# Rust projects
cargo audit && cargo clippy -- -W clippy::security

# Container security stack
trivy image --severity HIGH,CRITICAL myimage:latest && \
hadolint Dockerfile && \
trivy config --severity HIGH,CRITICAL .

# Full quick scan (all tools installed)
trufflehog filesystem . --only-verified && \
npm audit --audit-level=high && \
semgrep --config=p/security-audit --config=p/secrets . && \
trivy fs --severity HIGH,CRITICAL .

# Comprehensive multi-ecosystem scan
snyk test --all-projects --severity-threshold=high

Escalation

Escalate to full loom-security-audit skill or senior-software-engineer agent (with /loom-security-audit and /loom-threat-model skills) when:

• Critical findings discovered
• Unusual or complex vulnerabilities
• Architecture-level security concerns
• Compliance-related questions
• Incident response needed