security-scan
Quick security audit to identify secrets and dangerous code patterns.
Install
mkdir -p .claude/skills/security-scan-lowyshin && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/9696" && unzip -o skill.zip -d .claude/skills/security-scan-lowyshin && rm skill.zipInstalls to .claude/skills/security-scan-lowyshin
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Performs a rapid security sweep for secrets, API keys, and common vulnerabilities using cross-platform platform tools.Key capabilities
- →Secret detection
- →Vulnerability scanning
- →Hardcoded key identification
How it works
Performs rapid grep-based scans for secrets and dangerous code patterns.
Inputs & outputs
When to use security-scan
- →Scan for hardcoded keys
- →Perform rapid security audit
- →Identify dangerous code patterns
About this skill
security-scan Skill
This skill performs a fast, grep-based security scan of the repository. It focuses on identifying hardcoded secrets and common misconfigurations.
🛠️ Usage
Trigger this skill before any git push or after significant code changes.
Scan Patterns
The following patterns are scanned using the grep_search platform tool:
| Category | Pattern | Description |
|---|---|---|
| Secrets | sk-[a-zA-Z0-9]{48} | OpenAI API Keys |
| Secrets | ghp_[a-zA-Z0-9]{36} | GitHub Personal Access Tokens |
| Secrets | AKIA[0-9A-Z]{16} | AWS Access Key IDs |
| Config | \.env$ | Unencrypted environment files |
| Vulnerability | eval\( | Dangerous eval usage |
| Vulnerability | dangerouslySetInnerHTML | Potential XSS (React) |
💻 Cross-Platform Implementation
This skill uses the platform-native grep_search API, which is optimized for Windows, Mac, and Linux. No extra binary installation (like rg) is required.
Example Scan Execution
// Step 1: Detect current OS (via env-check)
// Step 2: Use grep_search with absolute path
grep_search({
Query: "sk-[a-zA-Z0-9]{48}",
SearchPath: "/absolute/path/to/project",
IsRegex: true
});
🛡️ Response Actions
If a match is found:
- Stop: Do not proceed with the task until the vulnerability is addressed.
- Alert: Report the exact file and line number to the user.
- Fix: Recommend moving the secret to an environment variable or using a secret manager.
When not to use it
- →Complex security audits
Limitations
- →Not a full security audit
- →Regex-based
How it compares
Provides a fast, cross-platform sweep without external binary dependencies.
Compared to similar skills
security-scan side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| security-scan (this skill) | 0 | 4mo | Review | Beginner |
| senior-security | 31 | 7mo | Review | Advanced |
| fix-security-vulnerability | 7 | 2mo | Review | Intermediate |
| codebase-cleanup-deps-audit | 2 | 4mo | No flags | Intermediate |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by LowyShin
View all by LowyShin →You might also like
senior-security
davila7
Comprehensive security engineering skill for application security, penetration testing, security architecture, and compliance auditing. Includes security assessment tools, threat modeling, crypto implementation, and security automation. Use when designing security architecture, conducting penetration tests, implementing cryptography, or performing security audits.
fix-security-vulnerability
getsentry
Analyze and propose fixes for Dependabot security alerts
codebase-cleanup-deps-audit
sickn33
You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.
dependency-auditor
alirezarezvani
Check dependencies for known vulnerabilities using npm audit, pip-audit, etc. Use when package.json or requirements.txt changes, or before deployments. Alerts on vulnerable dependencies. Triggers on dependency file changes, deployment prep, security mentions.
security-scanning-security-dependencies
sickn33
You are a security expert specializing in dependency vulnerability analysis, SBOM generation, and supply chain security. Scan project dependencies across ecosystems to identify vulnerabilities, assess risks, and recommend remediation.
trivy-offline-vulnerability-scanning
benchflow-ai
Use Trivy vulnerability scanner in offline mode to discover security vulnerabilities in dependency files. This skill covers setting up offline scanning, executing Trivy against package lock files, and generating JSON vulnerability reports without requiring internet access.