Security scanning
Use when checking code for vulnerabilities, linting shell scripts, scanning containers or IaC for security issues, or managing encrypted secretsFrom its SKILL.md
npx -y skills add ykotik/cli-power-skills --skill security-scanningAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its file declares
Copied from the file, not written here
The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
3.9 KB, 931 tokens by cl100k_base, as published. Nobody here has run it
Security Scanning
When to Use
- Scanning a project directory for known vulnerabilities (CVEs)
- Scanning a container image before deployment
- Scanning Infrastructure-as-Code (Terraform, CloudFormation) for misconfigurations
- Linting shell scripts for bugs, pitfalls, and unsafe patterns
- Encrypting or decrypting secrets stored in YAML/JSON config files
- Checking dependencies for known security issues
Tools
| Tool | Purpose | Structured output |
|---|---|---|
| Trivy | Vulnerability scanner for filesystems, containers, IaC | --format json or --format sarif |
| ShellCheck | Static analysis and linting for shell scripts | -f json for JSON output |
| sops | Encrypt/decrypt secrets in YAML, JSON, ENV files | Outputs decrypted file to stdout |
Patterns
Scan project directory for vulnerabilities
trivy fs --format json --output results.json .
Scan project and show results in terminal
trivy fs --severity HIGH,CRITICAL .
Scan a container image
trivy image --format json --output scan.json nginx:latest
Scan Terraform files for misconfigurations
trivy config --format json .
Scan a lockfile (package-lock.json, requirements.txt, etc.)
trivy fs --scanners vuln --format json package-lock.json
Generate SARIF report for CI integration
trivy fs --format sarif --output report.sarif .
Lint a shell script with JSON output
shellcheck -f json script.sh
Lint all shell scripts in a directory
shellcheck -f json *.sh scripts/*.sh
Lint with specific severity threshold
shellcheck -S warning -f json script.sh
Encrypt a secrets file with sops (using age key)
sops --encrypt --age $(cat ~/.config/sops/age/keys.txt | grep "public key:" | awk '{print $NF}') secrets.yaml > secrets.enc.yaml
Decrypt a secrets file to stdout
sops --decrypt secrets.enc.yaml
Edit encrypted file in-place
sops secrets.enc.yaml
Decrypt a single value
sops --decrypt --extract '["database"]["password"]' secrets.enc.yaml
Pipelines
Scan and summarize critical findings
trivy fs --format json . | jq '[.Results[] | .Vulnerabilities[]? | select(.Severity == "CRITICAL") | {id: .VulnerabilityID, pkg: .PkgName, title: .Title}]'
Each stage: Trivy scans and outputs JSON, jq filters to critical vulnerabilities and extracts key fields.
Lint all shell scripts and count issues by severity
shellcheck -f json scripts/*.sh | jq 'group_by(.level) | map({level: .[0].level, count: length})'
Each stage: ShellCheck lints all scripts to JSON, jq groups and counts by severity level.
Scan image and fail if critical vulns found
trivy image --format json myapp:latest | jq -e '[.Results[] | .Vulnerabilities[]? | select(.Severity == "CRITICAL")] | length == 0'
Each stage: Trivy scans image, jq checks for critical vulns and exits non-zero if any found.
Prefer Over
- Prefer Trivy over manual
npm audit/pip audit— scans all ecosystems in one pass - Prefer ShellCheck over manual review for shell scripts — catches subtle quoting, globbing, and portability bugs
- Prefer sops over storing plaintext secrets — encryption at rest with version control compatibility
Do NOT Use When
- Reviewing business logic or application design flaws — these tools find known CVEs and script bugs, not logic errors
- Linting Python code — use Ruff (python-tooling skill) instead
- Linting JavaScript/TypeScript — use ESLint or Biome directly
- Managing runtime secrets (use Vault or environment variables for that)
What ships with it
Read from the repository
Just SKILL.md. No reference files, no scripts.
Gives 0 of the 12 instructions most security skills give in 931 tokens
Counted across 666 of the 889 authors here whose files we hold, read 2026-09-06
- Use parameterized queries for database accessin 82 of 666, across 79 files
- Hash passwords with BCryptin 55 of 666, across 39 files
- Implement rate limiting for public endpointsin 48 of 666, across 34 files
- Use environment variables for secretsin 35 of 666
- Scan dependencies for vulnerabilitiesin 35 of 666, across 24 files
- Validate and sanitize all user inputin 35 of 666, across 32 files
- Add security headers to all responsesin 34 of 666, across 20 files
- Validate all external input at the system boundaryin 26 of 666, across 25 files
- Use parameterized queries to prevent SQL injectionin 25 of 666, across 13 files
- Store secrets in Vault or environment variablesin 25 of 666, across 10 files
- Run containers as a non-root userin 21 of 666, across 18 files
- Validate all input using Bean Validationin 19 of 666, across 5 files
Said here and by no other author read
- Use ShellCheck for static analysis of shell scripts
- Use sops for encrypting and decrypting secrets
- Filter scan results using jq for specific severity levels
- Prefer Trivy over language-specific audit tools
- Prefer ShellCheck over manual shell script review
- Prefer sops over storing plaintext secrets
Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.