How do I install the Scan skill?

Run npx skillmds@latest add asiaostrich/scan in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

This skill has not completed SkillMD's automated safety review yet. Capability flags: reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Scan?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

AsiaOstrich (@asiaostrich) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Scan by asiaostrich — Agent Skill

Name: Scan
Rating: 4.2 (5 reviews)
Author: AsiaOstrich

Scan

Guide automated security scanning, dependency auditing, and secret detection. Use when: dependency audit, CVE scanning, secret detection, license compliance. Not for: manual threat modeling and secure design review — use /security; general code cleanliness — use /sweep. Keywords: scan, audit, CVE, dependency, secret, SBOM, vulnerability.

AsiaOstrich 731552e 3.9 KB Updated Sep 10, 2026

File contents

Security Scan Assistant | 安全掃描助手

Automate security scanning for dependencies, secrets, and license compliance.

自動化相依套件、機密資訊和授權合規的安全掃描。

Scan Types | 掃描類型

Type	Tool Examples	Purpose	用途
Dependency audit	npm audit, pip-audit, Snyk	Find known CVEs in dependencies	檢測相依套件已知 CVE
Secret detection	gitleaks, trufflehog	Find leaked credentials in code	偵測程式碼中洩漏的憑證
License compliance	license-checker, SPDX	Verify OSS license compatibility	驗證開源授權相容性
SAST	Semgrep, CodeQL	Static analysis for code patterns	靜態分析程式碼模式

Tool Integration | 工具整合

Tool	Command	Scope	範圍
npm audit	`npm audit --json`	Node.js dependencies	Node.js 相依套件
Snyk	`npx snyk test`	Multi-language deps	多語言相依套件
Trivy	`trivy fs .`	Filesystem & containers	檔案系統與容器
gitleaks	`gitleaks detect`	Git history secrets	Git 歷史機密
SPDX	`npx spdx-tool`	License SBOM generation	授權 SBOM 產出

Severity Classification & SLA | 嚴重程度分類與 SLA

Severity	SLA	Criteria	標準
Critical	24 hours	RCE, auth bypass, data exfil	遠端執行、認證繞過、資料外洩
High	72 hours	Privilege escalation, SQLi	權限提升、SQL 注入
Medium	2 weeks	XSS, CSRF, info disclosure	XSS、CSRF、資訊洩漏
Low	Next sprint	Missing headers, verbose errors	缺少 Header、冗長錯誤訊息

Workflow | 工作流程

SCAN ──► TRIAGE ──► PRIORITIZE ──► FIX ──► VERIFY

Scan — Run automated scanners on codebase and dependencies
Triage — Filter false positives, confirm real vulnerabilities
Prioritize — Rank by severity and exploitability
Fix — Apply patches, update dependencies, rotate secrets
Verify — Re-scan to confirm remediation

Usage | 使用方式

/scan                - Full scan (deps + secrets + license) | 完整掃描
/scan --deps         - Dependency audit only | 僅相依套件審計
/scan --secrets      - Secret detection only | 僅機密偵測
/scan --license      - License compliance check | 授權合規檢查

Next Steps Guidance | 下一步引導

After /scan completes, the AI assistant should suggest:

掃描完成。建議下一步 / Scan complete. Suggested next steps:

執行 /security 深入安全審查 ⭐ Recommended / 推薦 — Run deep security review

執行 /checkin 確認修復符合提交規範 — Verify fixes meet check-in standards

執行 /commit 提交安全修復 — Commit security fixes

更新相依套件 → npm update 或 pip install --upgrade — Update dependencies

Reference | 參考

Core standard: security-standards.md

Version History | 版本歷史

Version	Date	Changes	變更說明
1.0.0	2026-03-23	Initial release	初始版本

AI Agent Behavior | AI 代理行為

完整的 AI 行為定義請參閱對應的命令文件：/scan

For complete AI agent behavior definition, see the corresponding command file: /scan

License | 授權

CC BY 4.0 — Documentation content

---name: scandescription: Guide automated security scanning, dependency auditing, and secret detection. Use when: dependency audit, CVE scanning, secret detection, license compliance. Not for: manual threat modeling and secure design review — use /security; general code cleanliness — use /sweep. Keywords: scan, audit, CVE, dependency, secret, SBOM, vulnerability.---# Security Scan Assistant | 安全掃描助手Automate security scanning for dependencies, secrets, and license compliance.自動化相依套件、機密資訊和授權合規的安全掃描。## Scan Types | 掃描類型| Type | Tool Examples | Purpose | 用途 ||------|---------------|---------|------|| **Dependency audit** | npm audit, pip-audit, Snyk | Find known CVEs in dependencies | 檢測相依套件已知 CVE || **Secret detection** | gitleaks, trufflehog | Find leaked credentials in code | 偵測程式碼中洩漏的憑證 || **License compliance** | license-checker, SPDX | Verify OSS license compatibility | 驗證開源授權相容性 || **SAST** | Semgrep, CodeQL | Static analysis for code patterns | 靜態分析程式碼模式 |## Tool Integration | 工具整合| Tool | Command | Scope | 範圍 ||------|---------|-------|------|| npm audit | `npm audit --json` | Node.js dependencies | Node.js 相依套件 || Snyk | `npx snyk test` | Multi-language deps | 多語言相依套件 || Trivy | `trivy fs .` | Filesystem & containers | 檔案系統與容器 || gitleaks | `gitleaks detect` | Git history secrets | Git 歷史機密 || SPDX | `npx spdx-tool` | License SBOM generation | 授權 SBOM 產出 |## Severity Classification & SLA | 嚴重程度分類與 SLA| Severity | SLA | Criteria | 標準 ||----------|-----|----------|------|| **Critical** | 24 hours | RCE, auth bypass, data exfil | 遠端執行、認證繞過、資料外洩 || **High** | 72 hours | Privilege escalation, SQLi | 權限提升、SQL 注入 || **Medium** | 2 weeks | XSS, CSRF, info disclosure | XSS、CSRF、資訊洩漏 || **Low** | Next sprint | Missing headers, verbose errors | 缺少 Header、冗長錯誤訊息 |## Workflow | 工作流程```SCAN ──► TRIAGE ──► PRIORITIZE ──► FIX ──► VERIFY```1. **Scan** — Run automated scanners on codebase and dependencies2. **Triage** — Filter false positives, confirm real vulnerabilities3. **Prioritize** — Rank by severity and exploitability4. **Fix** — Apply patches, update dependencies, rotate secrets5. **Verify** — Re-scan to confirm remediation## Usage | 使用方式```/scan - Full scan (deps + secrets + license) | 完整掃描/scan --deps - Dependency audit only | 僅相依套件審計/scan --secrets - Secret detection only | 僅機密偵測/scan --license - License compliance check | 授權合規檢查```## Next Steps Guidance | 下一步引導After `/scan` completes, the AI assistant should suggest:> **掃描完成。建議下一步 / Scan complete. Suggested next steps:**> - 執行 `/security` 深入安全審查 ⭐ **Recommended / 推薦** — Run deep security review> - 執行 `/checkin` 確認修復符合提交規範 — Verify fixes meet check-in standards> - 執行 `/commit` 提交安全修復 — Commit security fixes> - 更新相依套件 → `npm update` 或 `pip install --upgrade` — Update dependencies## Reference | 參考- Core standard: [security-standards.md](../../core/security-standards.md)## Version History | 版本歷史| Version | Date | Changes | 變更說明 ||---------|------|---------|----------|| 1.0.0 | 2026-03-23 | Initial release | 初始版本 |## AI Agent Behavior | AI 代理行為> 完整的 AI 行為定義請參閱對應的命令文件：[`/scan`](../commands/scan.md#ai-agent-behavior--ai-代理行為)>> For complete AI agent behavior definition, see the corresponding command file: [`/scan`](../commands/scan.md#ai-agent-behavior--ai-代理行為)## License | 授權CC BY 4.0 — Documentation content

Frequently asked questions