security-scanner

j0KZ's avatarfrom j0KZ

Comprehensive security vulnerability scanning. Use when checking for OWASP vulnerabilities, scanning for secrets/API keys, auditing dependencies for CVEs, or running pre-commit security checks.

⭐0stars🔀0forks📁View on GitHub🕐Updated Dec 27, 2025
[Security Operations]

When & Why to Use This Skill

This Claude skill provides a comprehensive security vulnerability scanning suite designed to detect OWASP Top 10 risks, hardcoded secrets, and vulnerable dependencies. It empowers developers to automate security audits, ensure compliance with standards like GDPR and PCI-DSS, and integrate robust security checks directly into their development workflows or CI/CD pipelines.

Use Cases

  • Automated Code Audits: Scanning source code for common vulnerabilities like SQL Injection, XSS, and CSRF to ensure secure coding practices.
  • Secret Leak Prevention: Detecting hardcoded API keys, passwords, and tokens before they are committed to version control using specialized linting tools.
  • Dependency Management: Auditing project dependencies for known CVEs and automatically identifying insecure components in the software supply chain.
  • DevSecOps Integration: Implementing pre-commit hooks or pipeline steps to fail builds if high-severity security issues are detected, ensuring continuous security compliance.
namesecurity-scanner
description"Comprehensive security vulnerability scanning. Use when checking for OWASP vulnerabilities, scanning for secrets/API keys, auditing dependencies for CVEs, or running pre-commit security checks."

Security Scanner

Advanced security vulnerability detection and remediation for codebases

Quick Commands

# Quick security scan
npx @j0kz/security-scanner scan

# Check for secrets
npx secretlint "**/*"

# OWASP dependency check
npm audit fix

# Static analysis
npx eslint-plugin-security

Core Functionality

Key Features

  1. OWASP Top 10 Detection: SQL injection, XSS, CSRF, etc.
  2. Secret Scanning: API keys, passwords, tokens
  3. Dependency Vulnerabilities: Known CVEs in dependencies
  4. Code Patterns: Insecure coding practices
  5. Compliance Checking: GDPR, PCI-DSS, HIPAA patterns

Detailed Information

For comprehensive details, see:

cat .claude/skills/security-scanner/references/owasp-patterns.md

cat .claude/skills/security-scanner/references/secret-detection.md

cat .claude/skills/security-scanner/references/remediation-guide.md

Usage Examples

Example 1: Full Security Audit

import { SecurityScanner } from '@j0kz/security-scanner';

const scanner = new SecurityScanner({
  severity: 'high',
  includeDevDependencies: false
});

const results = await scanner.scan('./src');
console.log(`Found ${results.vulnerabilities.length} vulnerabilities`);

Example 2: Pre-commit Hook

#!/bin/sh
# .husky/pre-commit

npx @j0kz/security-scanner scan --staged --fail-on-high

Security Patterns Detected

  • SQL Injection risks
  • Cross-Site Scripting (XSS)
  • Command Injection
  • Path Traversal
  • Sensitive Data Exposure
  • XML External Entity (XXE)
  • Broken Authentication
  • Security Misconfiguration
  • Using Components with Known Vulnerabilities
  • Insufficient Logging

Configuration

{
  "security-scanner": {
    "rules": {
      "no-eval": "error",
      "no-implied-eval": "error",
      "no-hardcoded-secrets": "error",
      "sql-injection": "error"
    },
    "exclude": ["test/**", "*.test.js"],
    "secretPatterns": [
      "api[_-]?key",
      "secret",
      "password",
      "token"
    ]
  }
}

Notes

  • Integrates with GitHub Security Advisories
  • Supports custom rule definitions
  • Can generate security reports in SARIF format
  • Zero false positives mode available