Results for “repo-scan”

Scan source code repositories, CI/CD pipelines, and configuration files for exposed AWS credentials using TruffleHog, git-secrets, and AWS-native detection mechanisms to prevent credential theft and unauthorized account access.

Scan a GitHub repository's contribution conventions and write them to a replaceable local instructions block. Use when joining, forking, or cloning a repository, when the user asks how issues, pull requests, base branches, or work branches should be handled, or when `AGENTS.local.md` / `CLAUDE.local.md` should reflect the repository's actual contribution rules.

Run NVIDIA garak probe suites against an LLM endpoint to test for jailbreaks, prompt injection, data leakage, and toxic generation, then interpret the hit-rate report for triage and reporting.

Conducts systematic security code reviews to identify exploitable vulnerabilities, reporting only high-confidence findings after researching the codebase.

Perform a systematic diagnostic scan of an AI workflow across 5 quality dimensions — prompt quality, context efficiency, tool health, architecture fitness, and safety — producing a scored report with prioritized remediation actions.

Cross-repository dependency audit. Scans package manifests for outdated packages, security advisories, version conflicts, and license issues. Produces a prioritized update plan. Supports Node.js, Python, Rust, and Go projects.

Find broken links on any website. Crawls the page, checks every link for 404s, redirects, and timeouts. Reports dead links with their location. Uses Playwright MCP only — no signup.

Scans macOS or Windows disk usage with read-only commands, categorizes large items into auto-cleanable, manual-review, and cautious tiers, and generates an interactive HTML report with one-click deletion via a local web server.

Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance for code, infrastructure, and cloud environments.

Scaffolds a coder-eval task suite in a repository by scanning for testable components, writing one real task, and validating it.

Process PDF files: extract text and tables, merge, split, rotate, watermark, create, encrypt, and OCR scanned documents using Python libraries and command-line tools.

Process PDFs with Python libraries and command-line tools: extract text and tables, merge, split, rotate, create, watermark, encrypt, and OCR scanned documents.

Scan C# source files for hard-to-test static dependencies and produce a ranked report of static call sites by frequency.

Collects market data from Yahoo Finance and Exa, calculates technical indicators, scans watchlists, and generates market analysis reports to identify trading opportunities.

Reviews local branch changes for bugs, security vulnerabilities, and code quality issues, producing a prioritized report with severity ratings and concrete fixes.

Scans a codebase for deepening opportunities, presents them as a visual HTML report, then grills through the chosen one. Use when the user wants to improve codebase architecture or find refactoring opportunities.

Generate and maintain llms.txt files for AI discoverability. Scans repos to create curated content maps that help AI answer engines surface your project accurately. Implements the llms.txt specification from Answer.AI.

Quick WCAG accessibility scan of any URL. Checks color contrast, missing alt text, keyboard navigation, ARIA labels, heading hierarchy, and focus indicators. Produces a graded report. Uses Playwright MCP only — no signup.

Expert knowledge for Azure Repos development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, and integrations & coding patterns. Use when managing Azure Git/TFVC repos, branch policies/PRs, migrations from TFVC/SVN, CodeQL/GHAS scanning, or auth/permissions, and other Azure Repos related development tasks. Not for Azure DevOps (use azure-devops), Azure Boards (use azure-boards), Azure Pipelines (use azure-pipelines), Azure Artifacts (use azure-artifacts).

Read, extract, merge, split, rotate, encrypt, and create PDF files. Supports markdown-to-PDF conversion, table extraction, form filling, and OCR for scanned documents.

Discover and inventory undocumented API endpoints by comparing live traffic against OpenAPI specs, scanning code repositories, and analyzing cloud configurations.

Conduct a comprehensive external network penetration test to identify vulnerabilities in internet-facing infrastructure using PTES methodology, reconnaissance, scanning, exploitation, and reporting.

Scans GitHub repositories for failing or stuck Actions workflows, diagnoses root causes, and applies fixes such as canceling stuck runs, re-running failed jobs, and cleaning runner caches.

Process PDFs with Python libraries and command-line tools: merge, split, extract text and tables, create documents, OCR scanned files, add watermarks, and manage passwords.

Probe the forms on a page for validation gaps — missing required-field enforcement, no client-side validation, accepts malformed input, and absent error messaging. Reports per-field findings. Playwright MCP only, no signup.

Generates unit tests, integration tests, and E2E tests for React/Next.js applications by scanning components, analyzing coverage reports, and scaffolding Playwright test files.

Scans a codebase for Martin Fowler's catalog of code smells, reporting each with location, severity, and refactoring recommendations, and ranks files to build a prioritized refactoring queue.

Backs up the live global Claude Code configuration (settings.json, CLAUDE.md, statusline.ts) into a git repository, with an allowlist and secret scan to prevent leaking credentials.

Security audit and vulnerability scanner for AI agent skills before installation. Use when: (1) evaluating a skill from an untrusted source, (2) auditing a skill directory or git repo URL for malicious code, (3) pre-install security gate for Claude Code plugins, OpenClaw skills, or Codex skills, (4) scanning Python scripts for dangerous patterns like os.system, eval, subprocess, network exfiltration, (5) detecting prompt injection in SKILL.md files, (6) checking dependency supply chain risks, (7) verifying file system access stays within skill boundaries. Triggers: "audit this skill", "is this skill safe", "scan skill for security", "check skill before install", "skill security check", "skill vulnerability scan".

Composite skill — full security pass across secrets, dependencies, code paths, and OWASP risks. Chains security-audit (broad) + socket-audit (npm supply chain) + semgrep (pattern scan) + code-security (code review for vulns) in parallel, reconciles into one severity-ranked report with remediation plan. Use quarterly per active repo or before any release of security-sensitive code.

Enforces ESLint v9 flat config rules across monorepos by scanning changed files via git diff, applying auto-fixable rules, and generating per-package lint reports with severity breakdowns.

End-of-day response check and pipeline update. Run at 6 PM via cron. Checks all channels for replies via Chrome DevTools MCP + Zoho MCP, updates lead statuses, pauses cadence for responded leads, sends EOD report via Telegram.

Review a REST/HTTP API — from its OpenAPI spec or route code — for security gaps like missing auth, broken object-level authorization, no rate limiting, and verbose errors. Reports file:line. Pure Claude Code, no signup.

Set up pre-commit hooks on a Python project — standard file-hygiene checks plus a security gate (gitleaks secret scanning, Trivy filesystem scan for CVEs/secrets/misconfigs, and Bandit Python SAST). Use this whenever the user wants to add, configure, or fix pre-commit hooks on a Python repo, mentions .pre-commit-config.yaml, wants secret/vulnerability/SAST scanning on commits, or is setting up code-quality guardrails — even if they just say 'add pre-commit hooks' without naming the tools. Especially for uv-based GenAI/LLM backends. Handles the setup gotchas that break first-time installs: the Trivy binary, the required data/html.tpl report template, bandit[toml] + [tool.bandit] config, and the right .gitignore entries.

Security audit orchestrator for agent skills — scans for prompt injection, data exfiltration, credential theft, supply chain risks, and instruction hierarchy violations before any skill is installed, created, improved, or read from a GitHub repo. Load when creating skills from external sources, when improve-skills reads from GitHub repos, when research-skill fetches community SKILL.md files, when a user installs a third-party skill, or when the user asks to audit skill security, scan for injection, check if a skill is safe, scan all skills, or run a security sweep. Orchestrates all secure-* skills in sequence. Content is SAFE only if ALL secure-* skills return SAFE. 36% of community skills contain flaws (Snyk ToxicSkills 2026). This skill is the first line of defense.

Composite skill — land a safe first PR in an unfamiliar repo without rediscovery loops or guessing at conventions. Chains onboard-new-repo (architecture + scripts + CI scan) → context-pack (relevant files + standards + ADRs for the scoped change) → scope-and-execute (narrow the task) → test-driven-development (write failing test first) → pr-to-release (open the PR). Use the first time you contribute to a repo OR when an unfamiliar contributor needs a guided first change.