# Security Scanning

> Dependency audits, SAST, credential leak detection, and daily scans. Use when building or running Julia's security sentinel or setting up automated security checks.

- Skill: `abzhaw/security-scanning` (Agent Skill)
- Install (CLI): `npx skillmds@latest add abzhaw/security-scanning`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abzhaw/security-scanning/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: abzhaw (https://skillmd.com/u/abzhaw)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abzhaw/security-scanning

---


# Security Scanning

## Daily Scan Script Pattern
```bash
#!/bin/bash
LOG="$PROJECT_DIR/security-agent/memory/daily-report.log"
FINDINGS=0

log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*" | tee -a "$LOG"; }

# 1. Dependency audit
log "=== npm audit ==="
for dir in backend bridge frontend orchestrator cowork-mcp; do
  result=$(cd "$PROJECT_DIR/$dir" && npm audit --json 2>/dev/null)
  critical=$(echo "$result" | jq '.metadata.vulnerabilities.critical // 0')
  high=$(echo "$result" | jq '.metadata.vulnerabilities.high // 0')
  [ "$critical" -gt 0 ] && { log "🔴 CRITICAL in $dir: $critical"; FINDINGS=$((FINDINGS+1)); }
  [ "$high" -gt 0 ] && log "🟡 HIGH in $dir: $high"
done

# 2. Exposed secrets scan (git history)
log "=== Secret scan ==="
if git -C "$PROJECT_DIR" log --all --oneline -100 | xargs git show | grep -qE '(sk-[a-zA-Z0-9]{20,}|AIza[a-z0-9_-]{35})'; then
  log "🔴 Possible secret in git history!"; FINDINGS=$((FINDINGS+1))
fi

# 3. Open ports check
log "=== Open ports ==="
unexpected=$(netstat -an | grep LISTEN | grep -vE ':(3000|3001|3002|3003|5432|22) ')
[ -n "$unexpected" ] && log "⚠️ Unexpected ports: $unexpected"

# 4. Report
[ "$FINDINGS" -gt 0 ] && notify_raphael "Security scan: $FINDINGS finding(s) — check logs"
log "=== Scan complete. Findings: $FINDINGS ==="
```

## Tools
```bash
npm audit                        # Node.js dependency vulnerabilities
npm audit fix --force            # Auto-fix (test after!)
npx snyk test                    # More detailed scan via Snyk
grep -r "sk-" --include="*.ts"   # Quick secret leak check in source
git log --all -S "sk-"           # Check git history for secrets
```