# Security Scan

> Comprehensive security scanning for code, dependencies, and infrastructure. Detects vulnerabilities, misconfigurations, and security risks.

- Skill: `clowlove/security-scan` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add clowlove/security-scan`
- Raw SKILL.md: https://api.skillmd.com/api/skills/clowlove/security-scan/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: clowlove (https://skillmd.com/u/clowlove)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/clowlove/security-scan

---


# Security Scan

Comprehensive security scanning and vulnerability detection.

## Features

- 🔍 **Code Scan** — Static analysis for security issues
- 📦 **Dependency Scan** — Check for vulnerable packages
- 🌐 **Infrastructure Scan** — Cloud/Docker security
- 🔑 **Secret Scan** — Detect exposed credentials
- 📊 **Compliance** — SOC2, HIPAA, GDPR checks

## Usage

### Scan Project

```bash
# Full scan
hermes security scan /path/to/project

# Fast scan
hermes security scan /path/to/project --mode fast

# Specific checks
hermes security scan --checks secrets,vulns,configs
```

### Dependency Scan

```bash
# Scan dependencies
hermes security deps --file package-lock.json

# Python packages
hermes security deps --file requirements.txt

# Docker images
hermes security scan-image node:18-alpine
```

### Secret Detection

```bash
# Scan for secrets
hermes security secrets --path ./src/

# Git history
hermes security secrets --git-history
```

## Report

```bash
# Generate report
hermes security report --format html --output security-report.html

# Severity filter
hermes security report --severity critical,high
```

## Configuration

```yaml
# security-config.yml
scan:
  exclude: ["node_modules", ".git", "test/**"]
  severity_threshold: medium
  
secrets:
  patterns:
    - "api[_-]?key"
    - "password"
    - "secret"
    
dependencies:
  ignore: ["dev-only-pkg"]
```

## Pitfalls

1. **False Positives** — Always verify reported issues
2. **Performance** — Full scans can be slow on large codebases
3. **Credentials** — Don't commit API keys to scanner