Results for “repo-scan”

Local-first secret scanning for repos and git history. Use before every push, when scanning for exposed keys, checking for committed credentials, or auditing a repo for accidental secret leaks. Designed for Nick's workflow and safer than forcing suspicious marketplace secret scanners.

Scans source code repositories across C++, Android, iOS, and Web to classify files, detect embedded third-party libraries, and produce actionable four-level verdicts per module with interactive HTML reports.

Deploy and operate Greenbone/OpenVAS vulnerability management using the python-gvm library to create scan targets, execute vulnerability scans, and parse scan reports via GMP protocol.

Audits trending open-source repos for exploitable vulnerabilities using Semgrep, TruffleHog, osv-scanner, and Slither, then routes findings to responsible disclosure channels (PVR for code flaws, public PRs for dependency CVEs).

Configure GitHub Advanced Security with CodeQL to perform automated static analysis and vulnerability detection across repositories at enterprise scale.

Detect and prevent hardcoded secrets in git repositories using Gitleaks, including pre-commit hooks, CI/CD integration, custom rules, baseline management, and remediation workflows.

Scans the projects/ directory and reports the pipeline phase completion status for each Virtual Team project.

Cross-stack source code asset audit — classifies every file, detects embedded third-party libraries, and delivers actionable four-level verdicts per module with interactive HTML reports.

Cross-stack source code asset audit — classifies every file, detects embedded third-party libraries, and delivers actionable four-level verdicts per module with interactive HTML reports.

Audits source code across C++, Android, iOS, and Web to classify files, detect embedded third-party libraries, and produce four-level verdicts with interactive HTML reports.

Cross-stack source code asset audit — classifies every file, detects embedded third-party libraries, and delivers actionable four-level verdicts per module with interactive HTML reports.

Automate VirusTotal threat intelligence operations through Composio's toolkit via Rube MCP, including file scanning, URL analysis, and report retrieval.

任意のリポジトリ（アプリ/ライブラリ/運用スクリプト/コンテンツ等）の種別を判定し、 種別に応じた評価軸（品質・テスト・依存、または検証ゲート等）で**実測ベース**評価して優先度付き改善案を出すスキル。 言語非依存（Python は AST 詳細・その他は近似と明記）。ベンダーコード混入・除外の空振り・偽の成功終了コードなど、 「黙って間違った数値を出す」失敗を構造的に封じる。 「リポジトリレビューして」「コード品質を評価して」「このプロジェクトを診断して」「包括レビュー」「repo-review」 「アーキテクチャ評価して」等で発火。/repo-review でも起動。

Scans installed or specified agent skills for advertising, covert commercial intent, task hijacking, suspicious external calls, and sensitive-data access. Reports findings first and quarantines only after explicit user confirmation.

Protocol for monitoring repo changes and extracting new knowledge.

Install, configure, and operate Strix for AI-driven application security testing. Use when you need to run authorized vulnerability scans against local codebases, GitHub repositories, staging URLs, domains, or CI pipelines; configure Docker and LLM providers; choose quick, standard, or deep scan depth; or pass authenticated testing instructions to Strix. Triggers on: strix, ai pentest, vulnerability scan cli, appsec scan, bug bounty automation, strix ci, strix docker, strix scan mode, strix instruction file, headless security scan.

For a repository in the babysitter-users catalog, locate its babysitter processes and any committed runs (.a5c/runs/<runId>/) and perform a retrospective on a chosen run -- what went well, what failed, process suggestions, quality of effect design, breakpoint patterns -- mirroring the /babysitter:retrospect workflow but applied to an external repo. Invoke when asked to "retrospect on repo X's run", "analyze how someone else used babysitter", or "review an external babysitter run".

Cross-repository dependency audit. Scans package manifests for outdated packages, security advisories, version conflicts, and license issues. Produces a prioritized update plan. Supports Node.js, Python, Rust, and Go projects.

Systematic workflow for analyzing a cloned GitHub repository. Use when you've cloned a repo and want to extract its tech stack, architecture, key patterns, and what to adopt into your system.

Reconcile repository issues, pull requests, merge requests, local git state, commits, and pushes across GitHub, GitLab, Gitea, Forgejo, Codeberg, Bitbucket, Azure DevOps, and SourceHut.

Onboard into an unfamiliar repository fast before making any changes

Extract actionable patterns, architecture decisions, code conventions, and skill-relevant insights from GitHub/GitLab repositories. Assess repo credibility, run the full security scan pipeline, and apply findings to existing skills, new skills, or the current project. Load when the user asks to learn from a repo, extract patterns from a codebase, study a repository, or analyze a repo for reusable techniques. Also triggers on "learn from this repo", "learn from this repository", "what can we learn from this codebase", "extract patterns from this repo", "study this repo".

Harness Audit

Find dead code in a repo — unused exports, unreferenced files, unreachable branches, unused imports, and declared-but-unused dependencies. Reports each with file:line and a safe-to-remove confidence. Pure Claude Code, no signup.

Evaluates RAG pipelines using a filesystem-based benchmark with corpus/ and train.json, running evaluate_rag.py to tune retrieval and generation flags and interpret RAGAS metrics.

Scan for OSS tool opportunities from npm gaps, GitHub trends, and developer pain points

Scan codebase and git history for leaked secrets — API keys, tokens, passwords, private keys. Uses whispers-style regex patterns + gitleaks. Run as /leak-check before any git push. Alerts on Claude API keys, GitHub tokens, AWS credentials, and generic high-entropy strings.

Defines, validates, runs, resumes, and audits repo-local multi-step automations using the `asc workflow` CLI and `.asc/workflow.json`, including step outputs and safe release/TestFlight workflows.

Repo housekeeping: sync READMEs to match current architecture, remove dead files (logs, screenshots, deprecated code, build artifacts), update npm/pip/cargo dependencies to latest. Use when asked to: "housekeep", "clean up repo", "update README", "update dependencies", "fix vulnerabilities", "remove dead code", "tidy.

Run security audits, vulnerability scans, compliance checks, and incident response workflows for application security.