/security-scan

> Run comprehensive security audit: SAST, SCA, secret detection, config review.

170 stars

byMiosa-osa

View on GitHub Installation ↓

Best use case

/security-scan is best used when you need a repeatable AI agent workflow instead of a one-off prompt.

> Run comprehensive security audit: SAST, SCA, secret detection, config review.

Teams using /security-scan should expect a more consistent output, faster repeated execution, less prompt rewriting.

When to use this skill

You want a reusable workflow that can be run more than once with consistent structure.

When not to use this skill

You only need a quick one-off answer and do not need a reusable workflow.
You cannot install or maintain the underlying files, dependencies, or repository context.

Installation

Claude Code / Cursor / Codex

$curl -o ~/.claude/skills/security-scan/SKILL.md --create-dirs "https://raw.githubusercontent.com/Miosa-osa/canopy/main/library/skills/security/security-scan/SKILL.md"

Manual Installation

Download SKILL.md from GitHub
Place it in .claude/skills/security-scan/SKILL.md inside your project
Restart your AI agent — it will auto-discover the skill

How /security-scan Compares

Feature / Agent	/security-scan	Standard Approach
Platform Support	Not specified	Limited / Varies
Context Awareness	High	Baseline
Installation Complexity	Unknown	N/A

Frequently Asked Questions

What does this skill do?

> Run comprehensive security audit: SAST, SCA, secret detection, config review.

Where can I find the source code?

You can find the source code on GitHub using the link provided at the top of the page.

SKILL.md Source

# /security-scan

> Run comprehensive security audit: SAST, SCA, secret detection, config review.

## Usage
```
/security-scan [path] [--focus <owasp-category>] [--severity <critical|high|medium|low>]
```

## What It Does
Runs a multi-phase security audit covering static analysis (SAST), dependency scanning (SCA), secret detection, and configuration review. Maps findings to OWASP Top 10 categories with CVSS scoring. Produces a prioritized report with remediation guidance.

## Implementation

### Phase 1: Reconnaissance
Detect project type, languages, sensitive file patterns, existing security configs.

### Phase 2: Static Analysis (SAST)
- Semgrep with security-audit + owasp-top-ten rulesets
- Language-specific scanners (Bandit for Python, gosec for Go, ESLint security for JS/TS)

### Phase 3: Dependency Analysis (SCA)
- Trivy for universal vulnerability scanning
- Language-specific: npm audit, pip-audit, mix audit
- Focus: known CVEs (Critical/High), outdated packages, license compliance

### Phase 4: Secret Detection
- Gitleaks for fast scanning
- Patterns: AWS credentials, API keys, private keys, connection strings, JWTs

### Phase 5: Configuration Review
Security headers, CORS, cookie flags, TLS config, auth settings.

### Phase 6: Report
Prioritized findings with CVSS scores, OWASP mapping, CWE correlation, and remediation steps.

## Examples
```bash
# Full security scan
/security-scan

# Scan specific directory
/security-scan lib/

# Focus on injection vulnerabilities
/security-scan --focus A03

# Only show critical and high findings
/security-scan --severity high
```