Mk vulnerability scanner

Skill ngocsangyem/MeowKit/packages/mewkit/src/migrate/modules/codex/root/.agents/skills/mk-vulnerability-scanner

Production ready. AI Agent Workflow System for Claude Code

Install

npx -y skills add ngocsangyem/MeowKit --skill mk-vulnerability-scanner

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

15 stars15 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Vulnerability analysis: OWASP Top 10, current threat landscape, supply chain security, attack surface mapping, risk prioritization. Use for security audits. NOT for STRIDE/CSO infra audits (mk:cso).

SKILL.md

3.1 KB, as published. Nobody here has run it

Vulnerability Scanner

Think like an attacker, defend like an expert.

When to Use

Security audit of a project or module
Before shipping code that handles auth, payments, or user data
When asked to "scan for vulnerabilities", "security check", "audit security"
When mk:cso delegates specific scanning tasks

Core Principles

Principle	Application
Assume Breach	Design as if attacker already inside
Zero Trust	Never trust, always verify
Defense in Depth	Multiple layers, no single point
Least Privilege	Minimum required access only
Fail Secure	On error, deny access

Process

Map attack surface — entry points, data flows, trust boundaries, assets
Load scanning methodology — read references/scanning-methodology.md
Reconnaissance — understand technology stack, entry points, data flows
Discovery — configuration review, dependency analysis, code pattern search
Analysis — validate findings, eliminate false positives, score risks
Report — each finding: What, Where, Why, Impact, How to fix

Threat Modeling Questions

Before scanning, ask: What are we protecting? Who would attack? How? What's the impact?

References

Reference	When to load	Content
scanning-methodology.md	Step 2 — executing scan	OWASP Top 10, supply chain, code patterns, risk prioritization, reporting format

Runtime Scripts

Script	Purpose	Usage
`security-scan.py`	Security pattern scanning	`.agents/skills/.venv/bin/python3 .codex/scripts/security-scan.py`
`injection-audit.py`	Prompt injection detection	`.agents/skills/.venv/bin/python3 .codex/scripts/injection-audit.py`

Gotchas

False positives in test fixtures: Security scan flags intentionally insecure test data → Exclude test/fixtures/ and mocks/ from vulnerability scans
Dependency confusion attacks missed: Scanner checks known CVEs but not package name typosquatting → Cross-reference package names against known typosquat databases