astro44/security-scan

security-scan - Security Vulnerability Scanner

Scans codebase for security vulnerabilities using pattern matching and static analysis. Detects OWASP Top 10 issues, hardcoded credentials, and insecure coding patterns.

Input Schema

{
  "project_dir": "/path/to/project",
  "scope": "changed|all|ticket",
  "ticket_id": "TICKET-XXX",
  "checks": ["secrets", "owasp", "dependencies"]
}

Instructions

1. Secrets Detection

Scan for hardcoded credentials and API keys:

# Common secret patterns
grep -rn "password\s*=" --include="*.js" --include="*.ts" --include="*.py"
grep -rn "api_key\s*=" --include="*.js" --include="*.ts"
grep -rn "AWS_SECRET" --include="*"
grep -rn "PRIVATE_KEY" --include="*"

# Base64 encoded secrets (entropy check)
grep -rn "eyJ" --include="*.js"  # JWT tokens

# .env files in version control
git ls-files | grep -E "\.env$|\.env\."

2. OWASP Top 10 Checks

| Vulnerability | Pattern | Example | |---------------|---------|---------| | SQL Injection | query("SELECT * FROM " + var) | Use parameterized queries | | XSS | innerHTML = userInput | Use textContent or sanitize | | Command Injection | exec(userInput) | Validate/escape input | | Path Traversal | readFile(userPath) | Normalize and validate paths | | Insecure Deserialization | JSON.parse(untrusted) | Validate schema first |

# SQL Injection
grep -rn "query.*\+.*\$" --include="*.js"
grep -rn "execute.*%s" --include="*.py"

# XSS
grep -rn "innerHTML\s*=" --include="*.js" --include="*.jsx"
grep -rn "document\.write" --include="*.js"

# Command Injection
grep -rn "exec\s*(" --include="*.js"
grep -rn "subprocess\..*shell=True" --include="*.py"

# Path Traversal
grep -rn "\.\./" --include="*.js" --include="*.py"

3. Dependency Scanning

# Check for known vulnerable packages
npm audit --json 2>/dev/null
pip-audit --format json 2>/dev/null

4. Severity Classification

| Severity | Examples | CVSS Range | |----------|----------|------------| | CRITICAL | RCE, SQL Injection, hardcoded AWS keys | 9.0-10.0 | | HIGH | XSS, CSRF, auth bypass | 7.0-8.9 | | MEDIUM | Info disclosure, weak crypto | 4.0-6.9 | | LOW | Verbose errors, missing headers | 0.1-3.9 |

Output Format

{
  "skill": "security-scan",
  "status": "pass|fail|warning",
  "scan_id": "SEC-20260107-001",
  "timestamp": "2026-01-07T12:00:00Z",
  "files_scanned": 42,
  "summary": {
    "critical": 0,
    "high": 1,
    "medium": 2,
    "low": 3
  },
  "vulnerabilities": [
    {
      "id": "V-001",
      "severity": "HIGH",
      "category": "XSS",
      "cwe_id": "CWE-79",
      "title": "innerHTML with user input",
      "description": "User-controlled data assigned to innerHTML without sanitization",
      "location": {
        "file": "src/components/UserComment.js",
        "line": 42,
        "code_snippet": "element.innerHTML = comment.body"
      },
      "remediation": "Use textContent for plain text or sanitize with DOMPurify",
      "references": ["https://owasp.org/www-community/attacks/xss/"]
    }
  ],
  "secrets_found": [
    {
      "type": "api_key",
      "file": "src/config.js",
      "line": 15,
      "pattern": "API_KEY = 'sk-...'",
      "remediation": "Move to environment variable"
    }
  ],
  "dependency_vulnerabilities": [
    {
      "package": "lodash",
      "version": "4.17.19",
      "vulnerability": "Prototype Pollution",
      "severity": "HIGH",
      "fix_version": "4.17.21"
    }
  ],
  "errors": [],
  "warnings": [],
  "next_action": "proceed|fix|review"
}

Decision Logic

Any CRITICAL vulnerabilities?
    YES → status: "fail", next_action: "fix"

Any HIGH vulnerabilities?
    YES → status: "fail", next_action: "fix"

Any MEDIUM vulnerabilities?
    YES → status: "warning", next_action: "review"

Only LOW or no issues?
    YES → status: "pass", next_action: "proceed"

Usage Examples

Full security scan:

{
  "project_dir": "/projects/oxygen_site",
  "scope": "all",
  "checks": ["secrets", "owasp", "dependencies"]
}

Scan changed files only:

{
  "project_dir": "/projects/oxygen_site",
  "scope": "changed",
  "checks": ["secrets", "owasp"]
}

Quick secrets check:

{
  "project_dir": "/projects/api-service",
  "scope": "all",
  "checks": ["secrets"]
}

Ticket-specific scan:

{
  "project_dir": "/projects/api-service",
  "scope": "ticket",
  "ticket_id": "TICKET-API-001",
  "checks": ["owasp", "secrets"]
}

CWE Reference

| Category | CWE | Description | |----------|-----|-------------| | SQL Injection | CWE-89 | Improper neutralization of SQL | | XSS | CWE-79 | Improper neutralization of input | | Command Injection | CWE-78 | OS command injection | | Path Traversal | CWE-22 | Improper path limitation | | Hardcoded Credentials | CWE-798 | Use of hardcoded credentials | | Weak Crypto | CWE-327 | Use of broken crypto algorithm |

Token Efficiency

• Pattern-based detection (no LLM inference)
• Parallel file scanning
• ~10-60 second execution
• Returns actionable fix suggestions