Vulnerability scanning

Skill ulpi-io/plugin-marketplace/plugins/aj-geddes/skills/vulnerability-scanning

Automated vulnerability detection using OWASP tools, CVE databases, and security scanners. Use when performing security audits, compliance checks, or continuous security monitoring.From its SKILL.md

Install

npx -y skills add ulpi-io/plugin-marketplace --skill vulnerability-scanning

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.4 KB, 476 tokens by cl100k_base, as published. Nobody here has run it

Overview

Systematically identify security vulnerabilities in applications, dependencies, and infrastructure using automated scanning tools and manual security assessments.

When to Use

Pre-deployment security checks
Continuous security monitoring
Compliance audits (PCI-DSS, SOC 2)
Dependency vulnerability detection
Container security scanning
Infrastructure security assessment

Quick Start

Minimal working example:

// scanner.js - Comprehensive vulnerability scanning
const { exec } = require("child_process");
const util = require("util");
const fs = require("fs").promises;

const execPromise = util.promisify(exec);

class VulnerabilityScanner {
  constructor() {
    this.results = {
      dependencies: [],
      code: [],
      docker: [],
      secrets: [],
    };
  }

  async scanDependencies() {
    console.log("Scanning dependencies with npm audit...");

    try {
      const { stdout } = await execPromise("npm audit --json");
      const auditResults = JSON.parse(stdout);

      for (const [name, advisory] of Object.entries(
// ... (see reference guides for full implementation)

Reference Guides

Detailed implementations in the references/ directory:

Guide	Contents
Node.js Vulnerability Scanner	Node.js Vulnerability Scanner
Python OWASP Scanner	Python OWASP Scanner
CI/CD Integration - GitHub Actions	CI/CD Integration - GitHub Actions

Best Practices

✅ DO

Automate scans in CI/CD
Scan dependencies regularly
Use multiple scanning tools
Set severity thresholds
Track vulnerability trends
Scan containers and images
Monitor CVE databases
Document false positives

❌ DON'T

Skip vulnerability scanning
Ignore low severity issues
Trust single scanning tool
Bypass security gates
Commit secrets to repos

What ships with it: 5 files

12.4 KB alongside SKILL.md, 1 of them executable