Results for “repo-scan”

Performs a full-stack security posture assessment with 0-100 risk scoring, scanning dependencies, code patterns, configuration, and data handling, then produces a prioritized report and routes to specialized skills.

Extract actionable patterns, architecture decisions, code conventions, and skill-relevant insights from GitHub/GitLab repositories. Assess repo credibility, run the full security scan pipeline, and apply findings to existing skills, new skills, or the current project. Load when the user asks to learn from a repo, extract patterns from a codebase, study a repository, or analyze a repo for reusable techniques. Also triggers on "learn from this repo", "learn from this repository", "what can we learn from this codebase", "extract patterns from this repo", "study this repo".

Scan source code repositories, CI/CD pipelines, and configuration files for exposed AWS credentials using TruffleHog, git-secrets, and AWS-native detection mechanisms to prevent credential theft and unauthorized account access.

Scans macOS or Windows disk usage with read-only commands, categorizes large items into auto-cleanable, manual-review, and cautious tiers, and generates an interactive HTML report with one-click deletion via a local web server.

Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance for code, infrastructure, and cloud environments.

Reconcile repository issues, pull requests, merge requests, local git state, commits, and pushes across GitHub, GitLab, Gitea, Forgejo, Codeberg, Bitbucket, Azure DevOps, and SourceHut.

Scan codebase and git history for leaked secrets — API keys, tokens, passwords, private keys. Uses whispers-style regex patterns + gitleaks. Run as /leak-check before any git push. Alerts on Claude API keys, GitHub tokens, AWS credentials, and generic high-entropy strings.

Defines, validates, runs, resumes, and audits repo-local multi-step automations using the `asc workflow` CLI and `.asc/workflow.json`, including step outputs and safe release/TestFlight workflows.

Run security audits, vulnerability scans, compliance checks, and incident response workflows for application security.

Provides a repeatable, auditable workflow for large coding tasks by initializing repo-local task artifacts, installing subagent templates, and running a spec-freeze → build → evidence → verify → fix loop with fresh-session verification.

Reviews authorized diffs for auth, input, filesystem, network, secrets, parsers, injection, CI/CD, and supply-chain regressions.

Validate ransomware recovery plans by testing backup restore operations, measuring RTO/RPO targets, verifying data integrity, and documenting recovery gaps in an isolated lab environment.

Integrates SAST, DAST, and SCA security scanning into CI/CD pipelines using open-source tools like Semgrep, Trivy, OWASP ZAP, and Gitleaks.

Scaffolds a per-task verification skill for a repo, including a dev-local launcher, a browser driver, and a verification SOP that spawns a sub-agent to drive the app and produce proof.

Scaffolds a coder-eval task suite in a repository by scanning for testable components, writing one real task, and validating it.

Expert knowledge for Azure Repos development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, and integrations & coding patterns. Use when managing Azure Git/TFVC repos, branch policies/PRs, migrations from TFVC/SVN, CodeQL/GHAS scanning, or auth/permissions, and other Azure Repos related development tasks. Not for Azure DevOps (use azure-devops), Azure Boards (use azure-boards), Azure Pipelines (use azure-pipelines), Azure Artifacts (use azure-artifacts).

Discover and inventory undocumented API endpoints by comparing live traffic against OpenAPI specs, scanning code repositories, and analyzing cloud configurations.

Scans GitHub repositories for failing or stuck Actions workflows, diagnoses root causes, and applies fixes such as canceling stuck runs, re-running failed jobs, and cleaning runner caches.

Probe the forms on a page for validation gaps — missing required-field enforcement, no client-side validation, accepts malformed input, and absent error messaging. Reports per-field findings. Playwright MCP only, no signup.

Backs up the live global Claude Code configuration (settings.json, CLAUDE.md, statusline.ts) into a git repository, with an allowlist and secret scan to prevent leaking credentials.

End-of-day response check and pipeline update. Run at 6 PM via cron. Checks all channels for replies via Chrome DevTools MCP + Zoho MCP, updates lead statuses, pauses cadence for responded leads, sends EOD report via Telegram.

Set up pre-commit hooks on a Python project — standard file-hygiene checks plus a security gate (gitleaks secret scanning, Trivy filesystem scan for CVEs/secrets/misconfigs, and Bandit Python SAST). Use this whenever the user wants to add, configure, or fix pre-commit hooks on a Python repo, mentions .pre-commit-config.yaml, wants secret/vulnerability/SAST scanning on commits, or is setting up code-quality guardrails — even if they just say 'add pre-commit hooks' without naming the tools. Especially for uv-based GenAI/LLM backends. Handles the setup gotchas that break first-time installs: the Trivy binary, the required data/html.tpl report template, bandit[toml] + [tool.bandit] config, and the right .gitignore entries.

Crawl and validate all internal and external links across an AEM Edge Delivery Services site, producing a prioritized report of broken, redirecting, and insecure links.