security-scanner
Comprehensive security scanning for SAST, secrets, OWASP vulnerabilities, container and IaC security
Security Assessment
Detected risks:
About security-scanner
The Security Scanner Skill is a comprehensive tool designed to provide security analysis for codebases, ensuring that vulnerabilities, exposed secrets, security misconfigurations, and compliance violations are detected. This skill leverages several techniques such as Static Application Security Testing (SAST), secret detection, OWASP Top 10 checks, container security, and Infrastructure as Code (IaC) validation to help developers and security teams identify and fix security issues in their applications, containers, and infrastructure configurations. It addresses the growing need for robust security practices in modern software development, ensuring that code and infrastructure are secure from the start and remain compliant throughout the development lifecycle.
FAQ
What type of vulnerabilities does the security scanner detect?
The security scanner detects a wide range of vulnerabilities, including SQL injection, cross-site scripting (XSS), command injection, path traversal, insecure deserialization, XML external entity (XXE), server-side request forgery (SSRF), and insecure cryptography.
Can the security scanner detect exposed secrets in my code?
Yes, the security scanner can detect hardcoded secrets such as API keys, tokens, passwords, private keys, database connection strings, and OAuth tokens.
Which container technologies does this scanner support?
The scanner supports Docker and Kubernetes, validating Dockerfiles, container images, privilege escalation risks, exposed ports, and user permissions.
Does the scanner work with Infrastructure as Code (IaC) configurations?
Yes, the security scanner supports Infrastructure as Code (IaC) configurations, including Terraform, CloudFormation, Kubernetes manifests, Helm charts, and Ansible playbooks.
Is this scanner compatible with all third-party dependency managers?
The scanner supports popular dependency managers like npm, pip, and maven, allowing it to check for package vulnerabilities, outdated dependencies, and license compliance.
Install security-scanner
Quick Setup:
- Copy the skill folder to
.claude/skills/ - Claude will automatically detect and use the skill
Repository
benreceveur/claude-workflow-engine