Security scan

Skill fusengine/agents/plugins/security-expert/skills/security-scan

Redefining development through cognitive automation and collaborative agent systems.

Install

npx -y skills add fusengine/agents --skill security-scan

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

22 stars22 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Use when scanning for XSS, SQL injection, command injection, hardcoded secrets, or any OWASP Top 10 vulnerability across a codebase.

SKILL.md

2.9 KB, as published. Nobody here has run it

<objective> This skill orchestrates a full security scan across JavaScript/TypeScript, PHP, Python, Swift/iOS, Go, and Rust: it detects the language from project markers, loads the matching pattern set, runs the harness's automated scanner (OWASP patterns ported into `@fusengine/harness`), maps findings to OWASP Top 10 categories, and generates a structured report.

Pattern categories include XSS, SQL injection, command injection, unsafe code execution (eval/exec), SSRF, weak cryptography, hardcoded secrets, insecure deserialization, and path traversal/LFI/RFI, plus GraphQL-specific patterns (introspection, depth/complexity limiting, batching, authorization) when a GraphQL endpoint is present.

After scanning, it delegates fixes to the sniper agent with file:line, vulnerability, and fix — it does not apply fixes itself. </objective>

Security Scan Skill

Overview

Orchestrates the full security scanning workflow across all supported languages.

Supported Languages

Language	Marker Files	Pattern Count
JavaScript/TypeScript	package.json	25+
PHP	composer.json	20+
Python	requirements.txt, pyproject.toml	18+
Swift/iOS	Package.swift, *.xcodeproj	15+
Go	go.mod	12+
Rust	Cargo.toml	10+

Workflow

Detect language from project markers
Load patterns from references/scan-patterns.md
Run bun ${CLAUDE_PLUGIN_ROOT}/../node_modules/@fusengine/harness/dist/cli/bin.mjs scan <dir> for automated scanning (OWASP patterns ported into the harness)
Map findings to OWASP categories via references/owasp-top10.md
Generate report using references/templates/scan-report.md

Integration

After scanning, delegate fixes to sniper:

Agent(subagent_type="fuse-ai-pilot:sniper", prompt="Security fixes: [FILE:LINE] [VULN] [FIX]")

References

OWASP Top 10 Mapping
Scan Patterns by Language
Report Template
GraphQL Security Patterns — Load when the target exposes a GraphQL endpoint (introspection, depth/complexity limiting, batching, authorization checks).
Scan Patterns - Python, Swift/iOS, Go, Rust — Load when scanning Python, Swift/iOS, Go, or Rust source code (patterns not covered in scan-patterns.md).