Vulnerability scanner

Skill ngocsangyem/MeowKit/.claude/skills/vulnerability-scanner

Advanced vulnerability analysis principles. OWASP Top 10 baseline + current threat landscape awareness, Supply Chain Security, attack surface mapping, risk prioritization. Use when performing security audits, threat modeling, or OWASP reviews. NOT for STRIDE/CSO-mode infrastructure audits (see mk:cso).From its SKILL.md

Install

npx -y skills add ngocsangyem/MeowKit --skill vulnerability-scanner

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

14 stars14 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

3.6 KB, 547 tokens by cl100k_base, as published. Nobody here has run it

Vulnerability Scanner

Think like an attacker, defend like an expert.

When to Use

Security audit of a project or module
Before shipping code that handles auth, payments, or user data
When asked to "scan for vulnerabilities", "security check", "audit security"
When mk:cso delegates specific scanning tasks

Core Principles

Principle	Application
Assume Breach	Design as if attacker already inside
Zero Trust	Never trust, always verify
Defense in Depth	Multiple layers, no single point
Least Privilege	Minimum required access only
Fail Secure	On error, deny access

Process

Map attack surface — entry points, data flows, trust boundaries, assets
Load scanning methodology — read references/scanning-methodology.md
Reconnaissance — understand technology stack, entry points, data flows
Discovery — configuration review, dependency analysis, code pattern search
Analysis — validate findings, eliminate false positives, score risks
Report — each finding: What, Where, Why, Impact, How to fix

Threat Modeling Questions

Before scanning, ask: What are we protecting? Who would attack? How? What's the impact?

References

Reference	When to load	Content
scanning-methodology.md	Step 2 — executing scan	OWASP Top 10, supply chain, code patterns, risk prioritization, reporting format

Runtime Scripts

Script	Purpose	Usage
`security-scan.py`	Security pattern scanning	`.claude/skills/.venv/bin/python3 .claude/scripts/security-scan.py`
`injection-audit.py`	Prompt injection detection	`.claude/skills/.venv/bin/python3 .claude/scripts/injection-audit.py`

Gotchas

False positives in test fixtures: Security scan flags intentionally insecure test data → Exclude test/fixtures/ and mocks/ from vulnerability scans
Dependency confusion attacks missed: Scanner checks known CVEs but not package name typosquatting → Cross-reference package names against known typosquat databases

What ships with it: 1 file

3.6 KB alongside SKILL.md

references/

scanning-methodology.md3.6 KB