Security scan
Use for dependency audits (CVEs, outdated majors, paid licenses, bloat), secret scans, SAST, and container/filesystem scans. Not for low-risk UI-only tasks.From its SKILL.md
npx -y skills add mtvrkan/senior-dev-kit --skill security-scanAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 4 stars4 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
SKILL.md
1.9 KB, as published. Nobody here has run it
security-scan
Trigger: dep add/update, auth/payment/DB/API/secrets/CI/release changes, or explicit user request. Skip for UI-only tasks.
- Dependency audit (detect package manager):
pnpm audit|npm audit --audit-level=moderate|bun audit|pip-audit|cargo audit|govulncheck ./... - Dependency hygiene (full audits, not single-dep adds): outdated majors (breaking risk), paid licenses (flag — never silently keep; free alternatives in
agent_docs/dep-check-guide.md), unused/bloat. - Secret scan:
gitleaks detect --source . --no-banner --redact(missing → continue with available tools). - SAST:
semgrep scan --config auto .(missing → continue). Container/filesystem:trivy fs .(missing → note it).
Output
Group findings CRITICAL → HIGH → MEDIUM → LOW. Redact all secrets, tokens, connection strings — never print raw keys, passwords, or connection strings.
Dep findings: package@version: CVE — fix | outdated majors: current→latest — breaking risk | PAID LICENSE: package — alt: X.
End with: tools run | tools missing | overall risk assessment | ESCALATE: [security-guard code review — if a critical CVE has no patch | none]
Never auto-remove or upgrade — report only. Never npm audit fix --force. Paid-license flags block until the user confirms.
Complements security-review (manual auth/payment/injection logic review) — this skill runs automated tooling only.