ngmthaq/security-scanner

---

🔐 Security Scanner Skill

Purpose

Provide a reproducible, language-agnostic workflow to:

1. Detect dependency vulnerabilities (SCA)
2. Detect code-level issues (SAST)
3. Perform deep semantic security analysis (AppSec + AI security)
4. Produce actionable findings with remediation steps

---

Scope

• Workspace-wide (monorepo supported)
• Language-agnostic (Node.js, Python, Java, Go, .NET, etc.)
• Framework-agnostic (web, backend, mobile, AI systems)

---

Security Coverage + Examples

---

1. Dependency Vulnerabilities (SCA)

❌ Vulnerable

{
  "dependencies": {
    "lodash": "4.17.15"
  }
}

✅ Fixed

{
  "dependencies": {
    "lodash": "^4.17.21"
  }
}

---

2. Code-Level Issues (SAST)

❌ Unsafe execution

eval(userInput);

✅ Safe

// Avoid eval entirely
const parsed = JSON.parse(userInput);

---

❌ Hardcoded secret

API_KEY = "sk-123456"

✅ Safe

API_KEY = os.getenv("API_KEY")

---

3. Application Security (AppSec)

---

SQL Injection

❌ Vulnerable

const query = "SELECT * FROM users WHERE id = " + userId;

✅ Safe

db.query("SELECT * FROM users WHERE id = ?", [userId]);

---

XSS

❌ Vulnerable

<div dangerouslySetInnerHTML={{ __html: userInput }} />

✅ Safe

<div>{userInput}</div>

---

CSRF

❌ Vulnerable

POST /transfer
(no CSRF token)

✅ Safe

POST /transfer
X-CSRF-Token: <token>

---

Command Injection

❌ Vulnerable

os.system("rm -rf " + userInput)

✅ Safe

subprocess.run(["rm", "-rf", safe_path])

---

Broken Authorization

❌ Vulnerable

app.get("/admin", (req, res) => {
  res.send("admin data");
});

✅ Safe

app.get("/admin", authMiddleware("admin"), handler);

---

4. API Security

❌ Mass Assignment

User.create(req.body);

✅ Safe

User.create({
  name: req.body.name,
  email: req.body.email,
});

---

❌ Missing validation

app.post("/user", (req) => save(req.body));

✅ Safe

validate(schema, req.body);

---

5. AI / LLM Security

---

Prompt Injection

❌ Vulnerable

const prompt = "System: You are safe\nUser: " + userInput;

✅ Safe

const prompt = [
  { role: "system", content: "You are safe" },
  { role: "user", content: sanitize(userInput) },
];

---

Tool Injection

❌ Vulnerable

agent.run(userInput); // directly executes tools

✅ Safe

if (isAllowedTool(action)) {
  execute(action);
}

---

Data Exfiltration

❌ Vulnerable

return llm("Summarize: " + secretData);

✅ Safe

return llm("Summarize: " + redact(secretData));

---

Step-by-Step Process

---

Phase 1 — Project Discovery

Detect:

• Languages
• Lockfiles
• Frameworks
• Entry points

---

Phase 2 — Dependency Scanning (SCA)

Example Commands

npm audit --json
pip-audit --format=json
dotnet list package --vulnerable
govulncheck ./...

---

Phase 3 — Code Scanning (SAST)

Example (Semgrep)

semgrep --config=auto .

---

Phase 4 — Deep Security Audit

Data Flow Model

input → processing → sink

Example

❌ Vulnerable flow

req.query.q → string concat → SQL query

✅ Safe flow

req.query.q → validation → parameterized query

---

Phase 5 — Risk Evaluation

| Severity | Criteria | | -------- | --------------------------- | | CRITICAL | Remote exploit, high impact | | HIGH | Realistic attack vector | | MEDIUM | Limited scope | | LOW | Best practice issue |

---

Phase 6 — Safe Auto-Fix

Example

npm audit fix

---

Phase 7 — Reporting

Finding Example

[SEC-001] - SQL Injection
Severity: HIGH
Location: userService.js:42
Description: Unsanitized input used in SQL query
Impact: Data exfiltration
Fix: Use parameterized queries

---

Output Formats

JSON

{
  "type": "vulnerability",
  "category": "SQL Injection",
  "severity": "HIGH",
  "location": "userService.js:42",
  "fix": "Use parameterized queries"
}

---

Markdown Summary

• 2 Critical
• 5 High
• 3 Medium

Top Issues:

• SQL Injection in user service
• XSS in comment component

---

Decision Rules

• Fail CI on CRITICAL
• Flag HIGH for review
• Mark uncertain → "Needs Manual Review"

---

Example Prompts

• "Scan project and detect SQLi, XSS, CSRF, and prompt injection"
• "Run full security audit and fix safe issues"

---