Code-VulnScan — Deep Codebase Vulnerability Scanner
This skill performs comprehensive, flow-aware security analysis on any codebase. It combines taint tracking, control-flow analysis, business logic review, API security auditing, secret detection, configuration review, and dependency auditing to find real, exploitable vulnerabilities — not keyword matches.
- Use the IDE's own tools for reading, searching, and reasoning about code.
- Use local Python scripts for deterministic file enumeration, AST-based analysis, secret entropy scanning, dependency checking, state tracking, and report generation.
- Do not call external LLM-provider APIs as part of this skill.
- Every confirmed finding requires a verified evidence chain. Candidates without verification are never reported.
Command surface
vulnscan scan <path> [--lang python,javascript,...] [--severity critical,high,medium,low] [--exclude vendor,tests]vulnscan taint <file> [--lang <language>]vulnscan secrets <path>vulnscan deps <path>vulnscan config <path>vulnscan report [--run-id <id>] [--format markdown|html|json|sarif|all] [--min-severity medium]vulnscan statusvulnscan commit <hash> [--repo <path>] [--base <base-hash>] [--severity critical,high,medium,low]vulnscan diff <base> <head> [--repo <path>] [--severity critical,high,medium,low]vulnscan pr <pr-number> [--repo <path>] [--severity critical,high,medium,low]
Commit/diff mode: Scans only the files and code regions changed in a commit or between two refs. Faster than a full scan — designed for CI/CD pipelines and code review. Findings are tagged introduced_in_diff: true (new vulnerability in the changed code) or introduced_in_diff: false (pre-existing vulnerability in code called by the change). Use vulnscan commit HEAD to scan the most recent commit, vulnscan diff main HEAD to scan a feature branch, or vulnscan pr 42 to scan a GitHub PR diff.
Defaults: report every validated severity and auto-detect language from file extensions. Use --min-severity when the user explicitly requests a threshold.
Core architecture
sub-skills/ — cognitive instructions for each analysis phase (29 specialized reviewers)scripts/ — deterministic Python helpers for enumeration, AST analysis, entropy scanning, dependency checking, report generationresources/patterns/ — per-language source/sink/sanitizer pattern definitionsresources/references/ — CWE taxonomy, OWASP Top 10, false-positive guidanceworkspace/ — SQLite scan state, intermediate JSON outputs, final reports
The golden rule: evidence-based findings only
A confirmed finding requires all three:
- A source — user-controlled data enters the system (or a dangerous condition exists).
- A sink / consequence — a dangerous operation can be triggered.
- A path — source reaches sink with no effective mitigation in between.
Pattern-match candidates are never confirmed findings. Every candidate passes through sub-skills/false-positive-filter.md before being reported.
Vulnerability categories covered
| Category |
Technique |
CWE |
| SQL Injection |
Taint + AST |
CWE-89 |
| Command Injection |
Taint + AST |
CWE-78 |
| Path Traversal |
Taint + canonicalization check |
CWE-22 |
| XSS (Reflected/Stored/DOM) |
Taint + output context |
CWE-79 |
| SSRF |
Taint + URL validation check |
CWE-918 |
| Insecure Deserialization |
Taint + API check |
CWE-502 |
| Server-Side Template Injection |
Taint + template API check |
CWE-94 |
| Open Redirect |
Taint + redirect target check |
CWE-601 |
| XXE |
Config + parser API check |
CWE-611 |
| Auth Bypass / Broken Access Control |
Control flow + logic analysis |
CWE-287, CWE-285 |
| Broken Authentication |
Session + token analysis |
CWE-306, CWE-384 |
| IDOR / BOLA |
Authorization logic analysis |
CWE-639 |
| Mass Assignment |
API + model analysis |
CWE-915 |
| Business Logic Flaws |
Control flow + state analysis |
CWE-840 |
| Race Conditions / TOCTOU |
Concurrency + file op analysis |
CWE-362, CWE-367 |
| Weak Cryptography |
Algorithm + key analysis |
CWE-327, CWE-326 |
| Hardcoded Secrets |
Entropy + pattern detection |
CWE-798 |
| Insecure Randomness |
RNG API analysis |
CWE-338 |
| Dependency CVEs |
Manifest + version analysis |
CWE-1035 |
| Information Disclosure |
Error handling + logging analysis |
CWE-209 |
| Security Misconfiguration |
Config + header analysis |
CWE-16 |
| IaC Misconfigurations |
Dockerfile/K8s/Terraform analysis |
CWE-732, CWE-284 |
| Memory Safety (C/C++) |
Buffer + pointer analysis |
CWE-120, CWE-416 |
| ReDoS |
Regex complexity analysis |
CWE-1333 |
| GraphQL Security |
Query depth + introspection check |
CWE-284 |
| React / Client-Side App Security |
DOM sink + router + storage analysis |
CWE-79, CWE-601, CWE-922 |
| Go Service Security |
Handler + binding + timeout + goroutine analysis |
CWE-89, CWE-918, CWE-400 |
| Java / JVM Service Security |
Framework auth + binding + expression/ORM/parser analysis |
CWE-89, CWE-94, CWE-502 |
| PHP Web Application Security |
Framework auth + binding + SQL/template/file review |
CWE-89, CWE-79, CWE-915 |
| Ruby Web Application Security |
Callback/policy + strong-parameter + ORM/template review |
CWE-89, CWE-79, CWE-915 |
| .NET Web Application Security |
ASP.NET auth/binding + EF/Dapper/parser analysis |
CWE-89, CWE-502, CWE-639 |
| Rust Web Service Security |
Extractor + SQL/process/HTTP/file analysis |
CWE-89, CWE-78, CWE-918 |
| Architecture Flaws |
Trust boundary + tenant isolation analysis |
CWE-284, CWE-862 |
| Application-Layer Vulns |
Workflow + abuse-control analysis |
CWE-639, CWE-840 |
| Infrastructure Security |
Cloud IAM + network/runtime/storage posture |
CWE-284, CWE-732 |
| Commit-diff scoped analysis |
Changed-file taint + caller/callee tracing |
CWE-all |
Full analysis workflow
Phase 0: Strategy (always run first)
Read sub-skills/scan-strategy.md to produce a concrete scan plan:
- Detected languages, frameworks, entry points
- Prioritized file list
- Active vulnerability categories
- Fresh or resume decision
- Whether the scan needs React, Go, Java/Kotlin JVM, PHP, Ruby, .NET, Rust, architecture, or application-vulnerability deep review
python3 scripts/scan.py --path <target> --status-only
If a recent incomplete run exists, ask whether to resume or start fresh.
python3 scripts/scan.py --path <target> [--lang python,javascript] [--exclude vendor,tests,node_modules]
This populates workspace/scan_state.db with candidate findings. Review the summary before proceeding.
Phase 0A: Technology and architecture deep-review routing
Load these focused reviewers when the scan plan matches their trigger:
sub-skills/react-security-reviewer.md — React, Next.js, Remix, React Router, JSX/TSX, browser tokens, client routing, postMessage, or hydration data.sub-skills/go-security-reviewer.md — Go net/http, Gin, Echo, Fiber, Chi, Gorilla, gRPC, workers, request binding, or Go server hardening.sub-skills/java-security-reviewer.md — Java/Kotlin JVM services using Spring, Jakarta EE/Servlet/JAX-RS, Struts, JSF, Hibernate/JPA, Micronaut, Quarkus, JVM messaging, or async workers. For Android, also load mobile-security-reviewer.md.sub-skills/php-security-reviewer.md — Laravel, Symfony, WordPress, Drupal, Yii, CodeIgniter, custom PHP front controllers, Composer applications, or PHP workers.sub-skills/ruby-security-reviewer.md — Rails, Sinatra/Rack, Hanami, Active Record/Sequel, Ruby templates, channels, or background jobs.sub-skills/dotnet-security-reviewer.md — ASP.NET Core/MVC/Web API, minimal APIs, Blazor, EF Core, Dapper, SignalR, or .NET workers.sub-skills/rust-security-reviewer.md — Actix-web, Axum, Warp, Rocket, SQLx/Diesel, Tokio services, or Rust workers processing untrusted data.sub-skills/architecture-security-reviewer.md — multi-service systems, SaaS/tenant boundaries, workers/queues, plugins/connectors, cloud trust boundaries, service accounts.sub-skills/application-vuln-reviewer.md — IDOR/BOLA, CSRF, account recovery, mass assignment, file upload/download, session lifecycle, rate limits, billing/workflow abuse.sub-skills/infrastructure-security-reviewer.md — cloud IAM, network exposure, object storage, KMS/secrets, runtime platforms, CI/CD supply chain, audit/logging, backups.
These reviewers do not replace taint analysis. Use them to expand the entry-point list, identify non-obvious sources/sinks, and add manual review targets before Phase 1.
Phase 1: Taint and injection analysis (parallel)
Read sub-skills/taint-analyzer.md. Run per-file taint analysis:
python3 scripts/taint.py --file <path> --lang <language>
Use script output as a starting map. Read every flagged file directly and trace each candidate path step by step. Verify every taint path — source to sink — reading actual code at each hop. Interprocedural traces must follow function calls across file boundaries.
Covers: SQL injection, command injection, path traversal, XSS, SSRF, SSTI, XXE, deserialization, open redirect.
Phase 2: Input validation analysis
Read sub-skills/input-validator.md. For every entry point identified in Phase 0:
- Verify validation is present and appropriate for the sink context
- Check for allowlist vs blocklist approach
- Test regex anchoring, type juggling bypasses, encoding bypasses
- Check second-order validation gaps
Phase 3: Business logic and control flow analysis
Read sub-skills/business-logic-analyzer.md and sub-skills/application-vuln-reviewer.md. Analyze:
- Authentication and authorization decision points
- Workflow state machines (can steps be skipped or reversed?)
- Price/quantity/permission manipulation opportunities
- Race conditions and TOCTOU patterns
- Privilege escalation paths through indirect logic
- Account recovery, CSRF, rate limiting, upload/download, cache leakage, and session lifecycle gaps
Phase 4: API security analysis
Read sub-skills/api-security-reviewer.md. For every REST, GraphQL, or RPC endpoint:
- Check for IDOR/BOLA (missing object-level authorization)
- Check for mass assignment in request body → model binding
- Check for excessive data exposure in responses
- Check rate limiting, authentication enforcement
- GraphQL: introspection, depth limits, batch query abuse
If the system has multiple services, tenants, workers, plugins, or cloud resources, also read sub-skills/architecture-security-reviewer.md and verify authorization, tenant scoping, and trust-boundary enforcement across the full request/job path.
Phase 5: Authentication and authorization review
Read sub-skills/auth-reviewer.md. Examine:
- Authentication mechanisms and bypass paths
- Session management, fixation, expiry
- JWT/token construction and validation
- Authorization middleware — is it applied consistently?
- Privilege escalation and horizontal access control
Phase 6: Cryptography and secrets review
Read sub-skills/crypto-reviewer.md and sub-skills/secret-detector.md.
Run entropy-based secret scanning:
python3 scripts/secrets.py --path <target>
Analyze:
- Algorithm selection (MD5/SHA1 for security, ECB mode, DES/RC4)
- Key sizes and generation
- Hardcoded credentials, API keys, tokens
- IV/nonce reuse, predictable keys
- Certificate validation bypasses
Phase 7: Configuration and infrastructure security
Read sub-skills/config-security-reviewer.md, sub-skills/iac-security-reviewer.md, and sub-skills/infrastructure-security-reviewer.md.
Check:
- Security headers (CSP, HSTS, X-Frame-Options, CORS)
- Debug mode, verbose errors, stack traces in production
- TLS/SSL configuration
- Dockerfile, Kubernetes manifests, Terraform configs
- Cloud IAM policies, public storage buckets, open security groups
- Runtime platform posture, CI/CD deployment trust, KMS/secrets policy, audit logging, public snapshots/backups
Phase 8: Memory safety (C/C++/Rust only)
Read sub-skills/memory-safety-analyzer.md when the codebase includes C, C++, or unsafe Rust.
Covers: buffer overflows, use-after-free, format string vulnerabilities, integer overflows in allocation sizes, null pointer dereferences.
Phase 8A: Framework-specific review
When React/Next.js/TSX is present, read sub-skills/react-security-reviewer.md and verify client-side DOM XSS, open redirects, browser token storage, postMessage origin checks, hydration data leaks, and client-only authorization.
When Go is present, read sub-skills/go-security-reviewer.md and verify request body binding, SQL construction, command execution, SSRF, file access, template use, HTTP server timeouts, CORS, body limits, and concurrency races.
When a Java/JVM server stack is present, read sub-skills/java-security-reviewer.md and verify effective framework authorization, request/entity binding, SpEL/OGNL/EL, ORM query construction, deserialization/XML, outbound URL handling, archive/path safety, TLS/crypto, Actuator/admin exposure, logging, and async tenant/security-context propagation.
When PHP is present, read sub-skills/php-security-reviewer.md and verify route/middleware/capability authorization, request/model binding, raw ORM/SQL, template escape bypasses, wrappers and outbound URLs, redirects, uploads/archives, deserialization, debug surfaces, and job tenant context.
When Ruby is present, read sub-skills/ruby-security-reviewer.md and verify callbacks/policies, object and tenant authorization, strong parameters, raw ORM fragments, template escape bypasses, SSRF/redirect handling, uploads/archives, serialization, session configuration, and job context.
When a .NET web stack is present, read sub-skills/dotnet-security-reviewer.md and verify endpoint authorization, model binding/overposting, EF Core/Dapper/raw SQL, Razor/Blazor output, SSRF, redirects, files/uploads, XML/object deserialization, Data Protection, antiforgery, forwarded headers, and background-service tenant context.
When a Rust web stack is present, read sub-skills/rust-security-reviewer.md and verify extractor authorization, typed request limits, SQLx/Diesel/raw SQL, process execution, reqwest/hyper URL handling, files/uploads, templates/headers/redirects, serde parsing, unsafe/FFI boundaries, and task-local tenant context.
Phase 9: Error handling and information disclosure
Read sub-skills/error-handling-reviewer.md. Check:
- Stack traces and exception details leaked to clients
- Verbose SQL errors, file path disclosure
- Enumeration through differential error messages
- Logging of sensitive data (passwords, tokens, PII)
Phase 10: Dependency audit
python3 scripts/dependency.py --path <target>
Read sub-skills/dependency-auditor.md to assess exploitability of flagged packages. Check direct manifests and resolved lock state, including Python/Poetry/Pipenv, npm/Yarn/pnpm, Maven/Gradle catalogs and locks, Go modules and sums, Gemfile/Composer/Cargo locks, and NuGet project/central-package/lock/Paket files.
Phase 11: False positive elimination
Read sub-skills/false-positive-filter.md. Apply three-pass protocol to every candidate:
- Pass 1 — Source reachability: is the input genuinely user-controlled?
- Pass 2 — Path completeness: does the taint path hold end-to-end?
- Pass 3 — Exploitability: can an attacker realistically trigger this?
Only confirmed and likely findings survive to the report.
Phase 12: Classification and scoring
Read sub-skills/vuln-classifier.md. For every surviving finding assign:
- CWE identifier
- OWASP Top 10 / OWASP API Top 10 category
- CVSS v3.1 base score and vector string
- Severity:
critical, high, medium, low, informational
Update the database:
python3 scripts/scan.py --update-findings workspace/confirmed_findings.json
Phase 13: Report generation
Read sub-skills/report-generator.md. The Phase 12 --update-findings command
automatically generates Markdown, HTML, JSON, SARIF, the canonical confirmed-
findings JSON, and <target_path>/Vulnscan_results.md. This is mandatory even
when the completed review has no findings; submit [] to Phase 12 so the valid
empty reports are still produced.
Verify that every finding contains Vulnerability Name, Severity,
Exploitability, CVSS Score, CVSS Vector, OWASP Category, Vulnerability
Description, Impact, Affected Assets, and Remediation Guidelines. It must also
include a stable Finding ID, CWE, confidence, validation status, exact
locations, masked evidence or taint flow, attack prerequisites, and references.
To regenerate the complete artifact set for the latest completed run:
python3 scripts/report.py --format all
Do not mark the review complete unless every artifact was written successfully.
The in-project Markdown file is the primary human-readable deliverable and must
always exist at the end of a full scan.
Targeted scan commands
vulnscan taint <file>
- Read
sub-skills/taint-analyzer.md.
- Run:
python3 scripts/taint.py --file <file> [--lang <language>]
- Read the actual file and verify every path in the output.
- Report confirmed paths with taint trace.
vulnscan secrets <path>
- Run:
python3 scripts/secrets.py --path <path>
- Read
sub-skills/secret-detector.md to verify high-entropy hits.
vulnscan deps <path>
- Run:
python3 scripts/dependency.py --path <path>
- Read
sub-skills/dependency-auditor.md to assess exploitability.
vulnscan config <path>
- Read
sub-skills/config-security-reviewer.md.
- Read
sub-skills/iac-security-reviewer.md.
- Review all config, infra, and environment files in the path.
vulnscan status
python3 scripts/scan.py --status-only
Natural-language prompt examples
Scan this codebase for vulnerabilitiesFind SQL injection and XSS in this Flask appCheck for hardcoded secrets or weak cryptoAudit the authentication and authorization logicAre there any vulnerable dependencies?Check the taint flow from HTTP params to database callsFind command injection in this Node.js appReview the Dockerfile and Kubernetes configs for security issuesCheck the API endpoints for IDOR and mass assignmentFind any race conditions or business logic flawsFind React/Next.js client-side vulnerabilitiesReview this Go API for handler, binding, SSRF, and SQL injection flawsReview this Spring Boot or Jakarta EE service for JVM-specific vulnerabilitiesReview this Ktor service for Kotlin/JVM request-to-sink vulnerabilitiesReview this Laravel, Symfony, or WordPress application for framework-specific vulnerabilitiesReview this Rails or Sinatra application for authorization, strong-parameter, and ORM flawsReview this ASP.NET Core API for authorization, overposting, EF Core, and SSRF flawsReview this Axum or Actix-web service for extractor, SQL, process, and HTTP-client flawsLook for architecture and tenant-isolation vulnerabilitiesFind application-level vulns like account recovery, CSRF, upload, cache, and workflow abuseReview cloud infrastructure, IAM, storage, network exposure, and CI/CD deployment securityGive me a full security report in SARIF format
Reference files
sub-skills/scan-strategy.mdsub-skills/taint-analyzer.mdsub-skills/input-validator.mdsub-skills/business-logic-analyzer.mdsub-skills/application-vuln-reviewer.mdsub-skills/api-security-reviewer.mdsub-skills/react-security-reviewer.mdsub-skills/go-security-reviewer.mdsub-skills/java-security-reviewer.mdsub-skills/php-security-reviewer.mdsub-skills/ruby-security-reviewer.mdsub-skills/dotnet-security-reviewer.mdsub-skills/rust-security-reviewer.mdsub-skills/architecture-security-reviewer.mdsub-skills/infrastructure-security-reviewer.mdsub-skills/auth-reviewer.mdsub-skills/crypto-reviewer.mdsub-skills/secret-detector.mdsub-skills/config-security-reviewer.mdsub-skills/iac-security-reviewer.mdsub-skills/memory-safety-analyzer.mdsub-skills/error-handling-reviewer.mdsub-skills/dependency-auditor.mdsub-skills/vuln-classifier.mdsub-skills/false-positive-filter.mdsub-skills/report-generator.mdresources/references/cwe-taxonomy.mdresources/references/owasp-top10.mdresources/references/false-positive-guide.md
1---2name: code-vulnscan3description: Use this when the user wants to find security vulnerabilities in a codebase, perform a security audit, scan for CVEs, detect secrets, review React/Next.js, Go, Java/Kotlin JVM, PHP, Ruby, .NET, or Rust web services, audit architecture/application/infrastructure flaws, review auth/API/crypto/business logic, check IaC/cloud/runtime configs, or generate a vulnerability report. Performs taint-flow, control-flow, architecture, and exploitability analysis across Python, JS/TS, Java/Kotlin, Go, PHP, Ruby, C/C++, C#, Rust, and infrastructure.4---56# Code-VulnScan — Deep Codebase Vulnerability Scanner78This skill performs comprehensive, flow-aware security analysis on any codebase. It combines taint tracking, control-flow analysis, business logic review, API security auditing, secret detection, configuration review, and dependency auditing to find real, exploitable vulnerabilities — not keyword matches.910- Use the IDE's own tools for reading, searching, and reasoning about code.11- Use local Python scripts for deterministic file enumeration, AST-based analysis, secret entropy scanning, dependency checking, state tracking, and report generation.12- Do not call external LLM-provider APIs as part of this skill.13- Every confirmed finding requires a verified evidence chain. Candidates without verification are never reported.1415## Command surface1617- `vulnscan scan <path> [--lang python,javascript,...] [--severity critical,high,medium,low] [--exclude vendor,tests]`18- `vulnscan taint <file> [--lang <language>]`19- `vulnscan secrets <path>`20- `vulnscan deps <path>`21- `vulnscan config <path>`22- `vulnscan report [--run-id <id>] [--format markdown|html|json|sarif|all] [--min-severity medium]`23- `vulnscan status`24- `vulnscan commit <hash> [--repo <path>] [--base <base-hash>] [--severity critical,high,medium,low]`25- `vulnscan diff <base> <head> [--repo <path>] [--severity critical,high,medium,low]`26- `vulnscan pr <pr-number> [--repo <path>] [--severity critical,high,medium,low]`2728**Commit/diff mode:** Scans only the files and code regions changed in a commit or between two refs. Faster than a full scan — designed for CI/CD pipelines and code review. Findings are tagged `introduced_in_diff: true` (new vulnerability in the changed code) or `introduced_in_diff: false` (pre-existing vulnerability in code called by the change). Use `vulnscan commit HEAD` to scan the most recent commit, `vulnscan diff main HEAD` to scan a feature branch, or `vulnscan pr 42` to scan a GitHub PR diff.2930Defaults: report every validated severity and auto-detect language from file extensions. Use `--min-severity` when the user explicitly requests a threshold.3132## Core architecture3334- `sub-skills/` — cognitive instructions for each analysis phase (29 specialized reviewers)35- `scripts/` — deterministic Python helpers for enumeration, AST analysis, entropy scanning, dependency checking, report generation36- `resources/patterns/` — per-language source/sink/sanitizer pattern definitions37- `resources/references/` — CWE taxonomy, OWASP Top 10, false-positive guidance38- `workspace/` — SQLite scan state, intermediate JSON outputs, final reports3940## The golden rule: evidence-based findings only4142A confirmed finding requires **all three**:431. A **source** — user-controlled data enters the system (or a dangerous condition exists).442. A **sink / consequence** — a dangerous operation can be triggered.453. A **path** — source reaches sink with no effective mitigation in between.4647Pattern-match candidates are **never** confirmed findings. Every candidate passes through `sub-skills/false-positive-filter.md` before being reported.4849## Vulnerability categories covered5051| Category | Technique | CWE |52|----------|-----------|-----|53| SQL Injection | Taint + AST | CWE-89 |54| Command Injection | Taint + AST | CWE-78 |55| Path Traversal | Taint + canonicalization check | CWE-22 |56| XSS (Reflected/Stored/DOM) | Taint + output context | CWE-79 |57| SSRF | Taint + URL validation check | CWE-918 |58| Insecure Deserialization | Taint + API check | CWE-502 |59| Server-Side Template Injection | Taint + template API check | CWE-94 |60| Open Redirect | Taint + redirect target check | CWE-601 |61| XXE | Config + parser API check | CWE-611 |62| Auth Bypass / Broken Access Control | Control flow + logic analysis | CWE-287, CWE-285 |63| Broken Authentication | Session + token analysis | CWE-306, CWE-384 |64| IDOR / BOLA | Authorization logic analysis | CWE-639 |65| Mass Assignment | API + model analysis | CWE-915 |66| Business Logic Flaws | Control flow + state analysis | CWE-840 |67| Race Conditions / TOCTOU | Concurrency + file op analysis | CWE-362, CWE-367 |68| Weak Cryptography | Algorithm + key analysis | CWE-327, CWE-326 |69| Hardcoded Secrets | Entropy + pattern detection | CWE-798 |70| Insecure Randomness | RNG API analysis | CWE-338 |71| Dependency CVEs | Manifest + version analysis | CWE-1035 |72| Information Disclosure | Error handling + logging analysis | CWE-209 |73| Security Misconfiguration | Config + header analysis | CWE-16 |74| IaC Misconfigurations | Dockerfile/K8s/Terraform analysis | CWE-732, CWE-284 |75| Memory Safety (C/C++) | Buffer + pointer analysis | CWE-120, CWE-416 |76| ReDoS | Regex complexity analysis | CWE-1333 |77| GraphQL Security | Query depth + introspection check | CWE-284 |78| React / Client-Side App Security | DOM sink + router + storage analysis | CWE-79, CWE-601, CWE-922 |79| Go Service Security | Handler + binding + timeout + goroutine analysis | CWE-89, CWE-918, CWE-400 |80| Java / JVM Service Security | Framework auth + binding + expression/ORM/parser analysis | CWE-89, CWE-94, CWE-502 |81| PHP Web Application Security | Framework auth + binding + SQL/template/file review | CWE-89, CWE-79, CWE-915 |82| Ruby Web Application Security | Callback/policy + strong-parameter + ORM/template review | CWE-89, CWE-79, CWE-915 |83| .NET Web Application Security | ASP.NET auth/binding + EF/Dapper/parser analysis | CWE-89, CWE-502, CWE-639 |84| Rust Web Service Security | Extractor + SQL/process/HTTP/file analysis | CWE-89, CWE-78, CWE-918 |85| Architecture Flaws | Trust boundary + tenant isolation analysis | CWE-284, CWE-862 |86| Application-Layer Vulns | Workflow + abuse-control analysis | CWE-639, CWE-840 |87| Infrastructure Security | Cloud IAM + network/runtime/storage posture | CWE-284, CWE-732 |88| Commit-diff scoped analysis | Changed-file taint + caller/callee tracing | CWE-all |8990## Full analysis workflow9192### Phase 0: Strategy (always run first)9394Read `sub-skills/scan-strategy.md` to produce a concrete scan plan:95- Detected languages, frameworks, entry points96- Prioritized file list97- Active vulnerability categories98- Fresh or resume decision99- Whether the scan needs React, Go, Java/Kotlin JVM, PHP, Ruby, .NET, Rust, architecture, or application-vulnerability deep review100101```bash102python3 scripts/scan.py --path <target> --status-only103```104105If a recent incomplete run exists, ask whether to resume or start fresh.106107```bash108python3 scripts/scan.py --path <target> [--lang python,javascript] [--exclude vendor,tests,node_modules]109```110111This populates `workspace/scan_state.db` with candidate findings. Review the summary before proceeding.112113---114115### Phase 0A: Technology and architecture deep-review routing116117Load these focused reviewers when the scan plan matches their trigger:118119- `sub-skills/react-security-reviewer.md` — React, Next.js, Remix, React Router, JSX/TSX, browser tokens, client routing, postMessage, or hydration data.120- `sub-skills/go-security-reviewer.md` — Go `net/http`, Gin, Echo, Fiber, Chi, Gorilla, gRPC, workers, request binding, or Go server hardening.121- `sub-skills/java-security-reviewer.md` — Java/Kotlin JVM services using Spring, Jakarta EE/Servlet/JAX-RS, Struts, JSF, Hibernate/JPA, Micronaut, Quarkus, JVM messaging, or async workers. For Android, also load `mobile-security-reviewer.md`.122- `sub-skills/php-security-reviewer.md` — Laravel, Symfony, WordPress, Drupal, Yii, CodeIgniter, custom PHP front controllers, Composer applications, or PHP workers.123- `sub-skills/ruby-security-reviewer.md` — Rails, Sinatra/Rack, Hanami, Active Record/Sequel, Ruby templates, channels, or background jobs.124- `sub-skills/dotnet-security-reviewer.md` — ASP.NET Core/MVC/Web API, minimal APIs, Blazor, EF Core, Dapper, SignalR, or .NET workers.125- `sub-skills/rust-security-reviewer.md` — Actix-web, Axum, Warp, Rocket, SQLx/Diesel, Tokio services, or Rust workers processing untrusted data.126- `sub-skills/architecture-security-reviewer.md` — multi-service systems, SaaS/tenant boundaries, workers/queues, plugins/connectors, cloud trust boundaries, service accounts.127- `sub-skills/application-vuln-reviewer.md` — IDOR/BOLA, CSRF, account recovery, mass assignment, file upload/download, session lifecycle, rate limits, billing/workflow abuse.128- `sub-skills/infrastructure-security-reviewer.md` — cloud IAM, network exposure, object storage, KMS/secrets, runtime platforms, CI/CD supply chain, audit/logging, backups.129130These reviewers do not replace taint analysis. Use them to expand the entry-point list, identify non-obvious sources/sinks, and add manual review targets before Phase 1.131132---133134### Phase 1: Taint and injection analysis (parallel)135136Read `sub-skills/taint-analyzer.md`. Run per-file taint analysis:137138```bash139python3 scripts/taint.py --file <path> --lang <language>140```141142Use script output as a starting map. **Read every flagged file directly** and trace each candidate path step by step. Verify every taint path — source to sink — reading actual code at each hop. Interprocedural traces must follow function calls across file boundaries.143144Covers: SQL injection, command injection, path traversal, XSS, SSRF, SSTI, XXE, deserialization, open redirect.145146---147148### Phase 2: Input validation analysis149150Read `sub-skills/input-validator.md`. For every entry point identified in Phase 0:151- Verify validation is present and appropriate for the sink context152- Check for allowlist vs blocklist approach153- Test regex anchoring, type juggling bypasses, encoding bypasses154- Check second-order validation gaps155156---157158### Phase 3: Business logic and control flow analysis159160Read `sub-skills/business-logic-analyzer.md` and `sub-skills/application-vuln-reviewer.md`. Analyze:161- Authentication and authorization decision points162- Workflow state machines (can steps be skipped or reversed?)163- Price/quantity/permission manipulation opportunities164- Race conditions and TOCTOU patterns165- Privilege escalation paths through indirect logic166- Account recovery, CSRF, rate limiting, upload/download, cache leakage, and session lifecycle gaps167168---169170### Phase 4: API security analysis171172Read `sub-skills/api-security-reviewer.md`. For every REST, GraphQL, or RPC endpoint:173- Check for IDOR/BOLA (missing object-level authorization)174- Check for mass assignment in request body → model binding175- Check for excessive data exposure in responses176- Check rate limiting, authentication enforcement177- GraphQL: introspection, depth limits, batch query abuse178179If the system has multiple services, tenants, workers, plugins, or cloud resources, also read `sub-skills/architecture-security-reviewer.md` and verify authorization, tenant scoping, and trust-boundary enforcement across the full request/job path.180181---182183### Phase 5: Authentication and authorization review184185Read `sub-skills/auth-reviewer.md`. Examine:186- Authentication mechanisms and bypass paths187- Session management, fixation, expiry188- JWT/token construction and validation189- Authorization middleware — is it applied consistently?190- Privilege escalation and horizontal access control191192---193194### Phase 6: Cryptography and secrets review195196Read `sub-skills/crypto-reviewer.md` and `sub-skills/secret-detector.md`.197198Run entropy-based secret scanning:199```bash200python3 scripts/secrets.py --path <target>201```202203Analyze:204- Algorithm selection (MD5/SHA1 for security, ECB mode, DES/RC4)205- Key sizes and generation206- Hardcoded credentials, API keys, tokens207- IV/nonce reuse, predictable keys208- Certificate validation bypasses209210---211212### Phase 7: Configuration and infrastructure security213214Read `sub-skills/config-security-reviewer.md`, `sub-skills/iac-security-reviewer.md`, and `sub-skills/infrastructure-security-reviewer.md`.215216Check:217- Security headers (CSP, HSTS, X-Frame-Options, CORS)218- Debug mode, verbose errors, stack traces in production219- TLS/SSL configuration220- Dockerfile, Kubernetes manifests, Terraform configs221- Cloud IAM policies, public storage buckets, open security groups222- Runtime platform posture, CI/CD deployment trust, KMS/secrets policy, audit logging, public snapshots/backups223224---225226### Phase 8: Memory safety (C/C++/Rust only)227228Read `sub-skills/memory-safety-analyzer.md` when the codebase includes C, C++, or unsafe Rust.229230Covers: buffer overflows, use-after-free, format string vulnerabilities, integer overflows in allocation sizes, null pointer dereferences.231232---233234### Phase 8A: Framework-specific review235236When React/Next.js/TSX is present, read `sub-skills/react-security-reviewer.md` and verify client-side DOM XSS, open redirects, browser token storage, postMessage origin checks, hydration data leaks, and client-only authorization.237238When Go is present, read `sub-skills/go-security-reviewer.md` and verify request body binding, SQL construction, command execution, SSRF, file access, template use, HTTP server timeouts, CORS, body limits, and concurrency races.239240When a Java/JVM server stack is present, read `sub-skills/java-security-reviewer.md` and verify effective framework authorization, request/entity binding, SpEL/OGNL/EL, ORM query construction, deserialization/XML, outbound URL handling, archive/path safety, TLS/crypto, Actuator/admin exposure, logging, and async tenant/security-context propagation.241242When PHP is present, read `sub-skills/php-security-reviewer.md` and verify route/middleware/capability authorization, request/model binding, raw ORM/SQL, template escape bypasses, wrappers and outbound URLs, redirects, uploads/archives, deserialization, debug surfaces, and job tenant context.243244When Ruby is present, read `sub-skills/ruby-security-reviewer.md` and verify callbacks/policies, object and tenant authorization, strong parameters, raw ORM fragments, template escape bypasses, SSRF/redirect handling, uploads/archives, serialization, session configuration, and job context.245246When a .NET web stack is present, read `sub-skills/dotnet-security-reviewer.md` and verify endpoint authorization, model binding/overposting, EF Core/Dapper/raw SQL, Razor/Blazor output, SSRF, redirects, files/uploads, XML/object deserialization, Data Protection, antiforgery, forwarded headers, and background-service tenant context.247248When a Rust web stack is present, read `sub-skills/rust-security-reviewer.md` and verify extractor authorization, typed request limits, SQLx/Diesel/raw SQL, process execution, reqwest/hyper URL handling, files/uploads, templates/headers/redirects, serde parsing, unsafe/FFI boundaries, and task-local tenant context.249250---251252### Phase 9: Error handling and information disclosure253254Read `sub-skills/error-handling-reviewer.md`. Check:255- Stack traces and exception details leaked to clients256- Verbose SQL errors, file path disclosure257- Enumeration through differential error messages258- Logging of sensitive data (passwords, tokens, PII)259260---261262### Phase 10: Dependency audit263264```bash265python3 scripts/dependency.py --path <target>266```267268Read `sub-skills/dependency-auditor.md` to assess exploitability of flagged packages. Check direct manifests and resolved lock state, including Python/Poetry/Pipenv, npm/Yarn/pnpm, Maven/Gradle catalogs and locks, Go modules and sums, Gemfile/Composer/Cargo locks, and NuGet project/central-package/lock/Paket files.269270---271272### Phase 11: False positive elimination273274Read `sub-skills/false-positive-filter.md`. Apply three-pass protocol to **every** candidate:2751. Pass 1 — Source reachability: is the input genuinely user-controlled?2762. Pass 2 — Path completeness: does the taint path hold end-to-end?2773. Pass 3 — Exploitability: can an attacker realistically trigger this?278279Only `confirmed` and `likely` findings survive to the report.280281---282283### Phase 12: Classification and scoring284285Read `sub-skills/vuln-classifier.md`. For every surviving finding assign:286- CWE identifier287- OWASP Top 10 / OWASP API Top 10 category288- CVSS v3.1 base score and vector string289- Severity: `critical`, `high`, `medium`, `low`, `informational`290291Update the database:292```bash293python3 scripts/scan.py --update-findings workspace/confirmed_findings.json294```295296---297298### Phase 13: Report generation299300Read `sub-skills/report-generator.md`. The Phase 12 `--update-findings` command301automatically generates Markdown, HTML, JSON, SARIF, the canonical confirmed-302findings JSON, and `<target_path>/Vulnscan_results.md`. This is mandatory even303when the completed review has no findings; submit `[]` to Phase 12 so the valid304empty reports are still produced.305306Verify that every finding contains Vulnerability Name, Severity,307Exploitability, CVSS Score, CVSS Vector, OWASP Category, Vulnerability308Description, Impact, Affected Assets, and Remediation Guidelines. It must also309include a stable Finding ID, CWE, confidence, validation status, exact310locations, masked evidence or taint flow, attack prerequisites, and references.311312To regenerate the complete artifact set for the latest completed run:313314```bash315python3 scripts/report.py --format all316```317318Do not mark the review complete unless every artifact was written successfully.319The in-project Markdown file is the primary human-readable deliverable and must320always exist at the end of a full scan.321322---323324## Targeted scan commands325326### `vulnscan taint <file>`3273281. Read `sub-skills/taint-analyzer.md`.3292. Run: `python3 scripts/taint.py --file <file> [--lang <language>]`3303. Read the actual file and verify every path in the output.3314. Report confirmed paths with taint trace.332333### `vulnscan secrets <path>`3343351. Run: `python3 scripts/secrets.py --path <path>`3362. Read `sub-skills/secret-detector.md` to verify high-entropy hits.337338### `vulnscan deps <path>`3393401. Run: `python3 scripts/dependency.py --path <path>`3412. Read `sub-skills/dependency-auditor.md` to assess exploitability.342343### `vulnscan config <path>`3443451. Read `sub-skills/config-security-reviewer.md`.3462. Read `sub-skills/iac-security-reviewer.md`.3473. Review all config, infra, and environment files in the path.348349### `vulnscan status`350351```bash352python3 scripts/scan.py --status-only353```354355---356357## Natural-language prompt examples358359- `Scan this codebase for vulnerabilities`360- `Find SQL injection and XSS in this Flask app`361- `Check for hardcoded secrets or weak crypto`362- `Audit the authentication and authorization logic`363- `Are there any vulnerable dependencies?`364- `Check the taint flow from HTTP params to database calls`365- `Find command injection in this Node.js app`366- `Review the Dockerfile and Kubernetes configs for security issues`367- `Check the API endpoints for IDOR and mass assignment`368- `Find any race conditions or business logic flaws`369- `Find React/Next.js client-side vulnerabilities`370- `Review this Go API for handler, binding, SSRF, and SQL injection flaws`371- `Review this Spring Boot or Jakarta EE service for JVM-specific vulnerabilities`372- `Review this Ktor service for Kotlin/JVM request-to-sink vulnerabilities`373- `Review this Laravel, Symfony, or WordPress application for framework-specific vulnerabilities`374- `Review this Rails or Sinatra application for authorization, strong-parameter, and ORM flaws`375- `Review this ASP.NET Core API for authorization, overposting, EF Core, and SSRF flaws`376- `Review this Axum or Actix-web service for extractor, SQL, process, and HTTP-client flaws`377- `Look for architecture and tenant-isolation vulnerabilities`378- `Find application-level vulns like account recovery, CSRF, upload, cache, and workflow abuse`379- `Review cloud infrastructure, IAM, storage, network exposure, and CI/CD deployment security`380- `Give me a full security report in SARIF format`381382---383384## Reference files385386- `sub-skills/scan-strategy.md`387- `sub-skills/taint-analyzer.md`388- `sub-skills/input-validator.md`389- `sub-skills/business-logic-analyzer.md`390- `sub-skills/application-vuln-reviewer.md`391- `sub-skills/api-security-reviewer.md`392- `sub-skills/react-security-reviewer.md`393- `sub-skills/go-security-reviewer.md`394- `sub-skills/java-security-reviewer.md`395- `sub-skills/php-security-reviewer.md`396- `sub-skills/ruby-security-reviewer.md`397- `sub-skills/dotnet-security-reviewer.md`398- `sub-skills/rust-security-reviewer.md`399- `sub-skills/architecture-security-reviewer.md`400- `sub-skills/infrastructure-security-reviewer.md`401- `sub-skills/auth-reviewer.md`402- `sub-skills/crypto-reviewer.md`403- `sub-skills/secret-detector.md`404- `sub-skills/config-security-reviewer.md`405- `sub-skills/iac-security-reviewer.md`406- `sub-skills/memory-safety-analyzer.md`407- `sub-skills/error-handling-reviewer.md`408- `sub-skills/dependency-auditor.md`409- `sub-skills/vuln-classifier.md`410- `sub-skills/false-positive-filter.md`411- `sub-skills/report-generator.md`412- `resources/references/cwe-taxonomy.md`413- `resources/references/owasp-top10.md`414- `resources/references/false-positive-guide.md`
Bhanunamikaze