Skip to the rows

agentsclimarketplace

Security analyzer

Skill bg-szy/TOP-SKILLS/skills/marketplace/security-analyzer

全球最大的 Claude Code 技能聚合库 · 收录 3900+ 来自 12+ 来源的技能，提供在线搜索与趋势分析看板 / The world's largest Claude Code skill aggregation hub — 3900+ skills from 12+ sources with online search and trend dashboard

Install

npx -y skills add bg-szy/TOP-SKILLS --skill security-analyzer

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
4 stars4 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Comprehensive security vulnerability analysis for codebases and infrastructure. Scans dependencies (npm, pip, gem, go, cargo), containers (Docker, Kubernetes), cloud IaC (Terraform, CloudFormation), and detects secrets exposure. Fetches live CVE data from OSV.dev, calculates risk scores, and generates phased remediation plans with TDD validation tests. Use when users mention security scan, vulnerability, CVE, exploit, security audit, penetration test, OWASP, hardening, dependency audit, container security, or want to improve security posture.

SKILL.md

4.6 KB, as published. Nobody here has run it

Security Analyzer

Analyze environments for vulnerabilities, fetch current CVE/exploit data, and generate phased remediation plans with TDD validation.

Quick Start

When the user requests a security scan:

Run environment discovery: python .claude/skills/security-analyzer/scripts/discover_env.py .
Save output to inventory.json
Run vulnerability scan: python .claude/skills/security-analyzer/scripts/fetch_vulns.py inventory.json
Save output to scan_results.json
Generate reports: python .claude/skills/security-analyzer/scripts/generate_report.py scan_results.json inventory.json

Workflow

Phase 1: Environment Discovery

Scan working directory for:

Dependencies: package.json, requirements.txt, Gemfile, go.mod, Cargo.toml, pom.xml
Containers: Dockerfile, docker-compose.yml, kubernetes/*.yaml
Cloud IaC: terraform/*.tf, cloudformation/*.yaml, *.bicep
Secrets: .env* files (flag exposure risk, never log values)

Run the discovery script:

python .claude/skills/security-analyzer/scripts/discover_env.py /path/to/project > inventory.json

Phase 2: Vulnerability Intelligence

Fetch current threat data using the vulnerability scanner:

python .claude/skills/security-analyzer/scripts/fetch_vulns.py inventory.json > scan_results.json

Source	Priority	Use For
CISA KEV	1	Actively exploited vulns (use WebSearch)
NVD	2	CVE details + CVSS scores (use WebSearch)
GitHub Advisories	3	Package-specific vulns (use WebSearch)
OSV.dev	4	Open source vulns (API in script)

For CISA KEV and additional context, supplement with:

WebSearch: "CVE-XXXX-YYYY CISA KEV exploit"

Phase 3: Risk Scoring

The scanner calculates risk scores using:

Risk = (CVSS * 0.3) + (Exploitability * 0.3) + (Criticality * 0.2) + (Exposure * 0.2)

Exploitability: 10=CISA KEV, 7=public exploit, 3=theoretical
Criticality: 10=auth/payment, 5=core business, 2=logging
Exposure: 10=internet-facing, 5=internal, 2=air-gapped

Phase 4: Phased Remediation

Generate reports with fix commands and validation tests:

python .claude/skills/security-analyzer/scripts/generate_report.py scan_results.json inventory.json

Each finding includes:

Vulnerability details + risk score
Actual fix code/patch (not just recommendations)
Pre-fix test (proves vuln exists)
Remediation unit tests (tests the fix code)
Post-fix validation (proves vuln resolved)

Phase 5: Reports

Output two reports:

security-report-technical.md — Full details for engineers
security-report-executive.md — Summary for leadership

See references/report-templates.md for output structure.

TDD Pattern

For each vulnerability, generate three test types:

def test_vuln_exists():
    """PASS before fix, FAIL after"""
    assert is_vulnerable("component") == True

def test_fix_works():
    """Unit test for remediation code"""
    result = apply_fix(vulnerable_config)
    assert result.is_secure()

def test_vuln_resolved():
    """FAIL before fix, PASS after"""
    assert is_vulnerable("component") == False

Fix Types by Finding

Finding	Output
Dependency CVE	Version bump command + lockfile update
Container issue	Dockerfile patch
IaC misconfiguration	Terraform/K8s fix
Code vulnerability	Source patch + test
Secret exposure	Rotation commands + `.gitignore` update

Example Interaction

User: "Run a security scan on this project"

Claude:

Discovers 47 npm dependencies, 3 Dockerfiles, 2 Terraform configs
Fetches current CVE data from OSV.dev
Identifies 12 vulnerabilities (2 critical, 4 high, 6 medium)
Generates phased remediation plan with:
- Actual fix commands (npm install [email protected])
- Code patches for IaC misconfigurations
- TDD tests proving each fix works
Outputs technical and executive reports

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.