Security scanner

Skill glincker/claude-code-marketplace/skills/security/security-scanner

Comprehensive security scanner for vulnerabilities, hardcoded secrets, and OWASP Top 10 issuesFrom its SKILL.md

Install

npx -y skills add glincker/claude-code-marketplace --skill security-scanner

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

5.4 KB, as published. Nobody here has run it

Security Scanner

Comprehensive security analysis detecting hardcoded secrets, SQL injection, XSS, insecure dependencies, and OWASP Top 10 vulnerabilities.

What This Skill Does

Scans for hardcoded secrets (API keys, passwords, tokens)
Detects SQL injection vulnerabilities
Finds XSS attack vectors
Checks insecure dependencies
Identifies authentication/authorization flaws
Reviews CORS and CSP configurations
Checks for insecure cryptography

Instructions

Phase 1: Secret Detection

Search for common secret patterns:

# API Keys
Grep for patterns:
- AWS: AKIA[0-9A-Z]{16}
- GitHub: ghp_[0-9a-zA-Z]{36}
- Slack: xox[baprs]-[0-9]{10,13}-[0-9a-zA-Z]{24,}
- Stripe: sk_live_[0-9a-zA-Z]{24}
- Private keys: -----BEGIN.*PRIVATE KEY-----

# Passwords
- password\s*=\s*["'][^"']+["']
- DB connection strings
- Hardcoded credentials

Example findings:

HIGH: Hardcoded AWS key found
File: src/config.js:12
Pattern: const AWS_KEY = "AKIAIOSFODNN7EXAMPLE"
Risk: Exposed AWS credentials
Fix: Use environment variables or secrets manager

Phase 2: Injection Vulnerabilities

SQL Injection:

# BAD: String concatenation
query = "SELECT * FROM users WHERE id = " + user_id

# GOOD: Parameterized query
query = "SELECT * FROM users WHERE id = ?"

Command Injection:

// BAD: Direct execution
exec(`ls ${userInput}`)

// GOOD: Sanitized input
execFile('ls', [sanitize(userInput)])

XSS Detection:

// BAD: innerHTML with user input
element.innerHTML = userInput

// GOOD: textContent or sanitize
element.textContent = userInput
// Or use DOMPurify
element.innerHTML = DOMPurify.sanitize(userInput)

Phase 3: Dependency Vulnerabilities

# Check for vulnerable dependencies
npm audit
pip-audit
cargo audit

# Generate report
npm audit --json > audit-report.json

Phase 4: OWASP Top 10 Checks

Broken Access Control
- Missing authorization checks
- Insecure direct object references
- Exposed admin endpoints
Cryptographic Failures
- Hardcoded encryption keys
- Weak algorithms (MD5, SHA1)
- Unencrypted sensitive data
Injection
- SQL, NoSQL, OS command, LDAP injection
- Unsanitized user input
Insecure Design
- Missing rate limiting
- No CSRF protection
- Weak session management
Security Misconfiguration
- Debug mode in production
- Default credentials
- Unnecessary services enabled

Scan Report Format

# Security Scan Report

**Scan Date**: 2025-01-13
**Project**: myapp
**Total Issues**: 12

## Critical (2)
1. Hardcoded AWS credentials
   - File: config/aws.js:5
   - Risk: Full AWS account compromise
   - Fix: Use AWS IAM roles or environment variables

2. SQL Injection vulnerability
   - File: api/users.js:45
   - Code: `SELECT * FROM users WHERE id = ${userId}`
   - Fix: Use parameterized queries

## High (5)
3. XSS vulnerability in search
   - File: components/Search.jsx:23
   - Risk: Arbitrary JavaScript execution
   - Fix: Sanitize user input with DOMPurify

4. Missing authentication on /admin endpoint
   - File: routes/admin.js
   - Risk: Unauthorized access to admin functions
   - Fix: Add authentication middleware

## Medium (3)
5. Weak CORS configuration
   - File: server.js:10
   - Issue: CORS set to *
   - Fix: Whitelist specific domains

## Low (2)
6. Console.log in production
   - Multiple files
   - Risk: Information disclosure
   - Fix: Remove or use proper logging

## Recommendations
1. Implement secrets management (AWS Secrets Manager, Vault)
2. Add input validation library (joi, express-validator)
3. Enable Content Security Policy
4. Implement rate limiting
5. Add security headers (helmet.js)

Auto-Fix Suggestions

// Before (Vulnerable)
const query = `SELECT * FROM users WHERE email = '${email}'`;

// After (Fixed)
const query = 'SELECT * FROM users WHERE email = ?';
db.execute(query, [email]);

Best Practices

Never commit secrets: Use .env files (in .gitignore)
Sanitize all input: Treat all user input as untrusted
Use prepared statements: Prevent SQL injection
Implement CSP: Mitigate XSS attacks
Regular dependency updates: Fix known vulnerabilities
Principle of least privilege: Minimal permissions

Tool Requirements

Read: Examine source code
Grep: Pattern matching for vulnerabilities
Glob: Find all relevant files
Bash: Run security tools (npm audit, etc.)

Examples

Example 1: Quick Scan

User: "Scan my code for security issues"

Output:

3 Critical: Hardcoded secrets
5 High: SQL injection, XSS
2 Medium: CORS misconfiguration
Auto-fix suggestions provided

Example 2: Dependency Audit

User: "Check for vulnerable dependencies"