How do I install the Security Scan skill?

Run npx skillmds@latest add filipemotta/security-scan in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Security Scan skill do?

Run a comprehensive security scan on the project (secrets, CVEs, Docker, IaC, RBAC) It is listed under DevOps & Infra on SkillMD.

Is Security Scan safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Security Scan?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Security Scan free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Security Scan?

filipemotta (@filipemotta) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Security Scan by filipemotta — Agent Skill

Name: Security Scan
Author: filipemotta

File contents

/security-scan

Data Collection

Secrets Detection: Scan source code for hardcoded credentials
- Patterns: AWS access keys (AKIA[0-9A-Z]{16}), tokens, passwords in config files
- Check: .env files committed to git, private keys in repo
- Tool: Grep with regex patterns + git log for history
Dependency Vulnerabilities: Check known CVEs
- Node.js: npm audit --json or yarn audit --json
- Python: pip audit --format=json
- Go: govulncheck ./...
- General: trivy fs --format json . (if available)
Dockerfile Analysis: Check container security
- Running as root (no USER directive)
- Using :latest tag instead of pinned versions
- Secrets passed via ARG/ENV or COPY
- Missing multi-stage build (large attack surface)
IaC Misconfigurations: Terraform / CloudFormation
- S3 buckets with public access
- Security Groups with 0.0.0.0/0 ingress
- Unencrypted storage (EBS, RDS, S3)
- Missing logging/audit trail
Kubernetes RBAC: If K8s manifests present
- ClusterRoleBindings with cluster-admin
- Wildcard permissions in Roles
- ServiceAccounts with excessive permissions

Security Checklist

Secrets: No hardcoded credentials in source code
Dependencies: No known critical/high CVEs
Docker: Images don't run as root, multi-stage build used
IaC: S3 not public, SGs without 0.0.0.0/0, encryption enabled
RBAC: No unnecessary cluster-admin bindings
TLS: Endpoints use HTTPS, certificates valid
Logging: Audit trail enabled
Secrets Mgmt: Using vault/external-secrets, not plain env vars

Output

Risk Level: Critical / High / Medium / Low
Findings: Categorized list by severity
- For each: file, line, description, remediation command
OWASP Top 10: Which risks apply to this project
Remediation: Specific command or change for each finding
Compliance: Status vs frameworks (SOC2, HIPAA, PCI-DSS basics)

---name: security-scandescription: Run a comprehensive security scan on the project (secrets, CVEs, Docker, IaC, RBAC)---# /security-scan## Data Collection1. **Secrets Detection**: Scan source code for hardcoded credentials - Patterns: AWS access keys (`AKIA[0-9A-Z]{16}`), tokens, passwords in config files - Check: `.env` files committed to git, private keys in repo - Tool: `Grep` with regex patterns + `git log` for history2. **Dependency Vulnerabilities**: Check known CVEs - Node.js: `npm audit --json` or `yarn audit --json` - Python: `pip audit --format=json` - Go: `govulncheck ./...` - General: `trivy fs --format json .` (if available)3. **Dockerfile Analysis**: Check container security - Running as root (no USER directive) - Using `:latest` tag instead of pinned versions - Secrets passed via ARG/ENV or COPY - Missing multi-stage build (large attack surface)4. **IaC Misconfigurations**: Terraform / CloudFormation - S3 buckets with public access - Security Groups with `0.0.0.0/0` ingress - Unencrypted storage (EBS, RDS, S3) - Missing logging/audit trail5. **Kubernetes RBAC**: If K8s manifests present - ClusterRoleBindings with `cluster-admin` - Wildcard permissions in Roles - ServiceAccounts with excessive permissions## Security Checklist- [ ] **Secrets**: No hardcoded credentials in source code- [ ] **Dependencies**: No known critical/high CVEs- [ ] **Docker**: Images don't run as root, multi-stage build used- [ ] **IaC**: S3 not public, SGs without 0.0.0.0/0, encryption enabled- [ ] **RBAC**: No unnecessary cluster-admin bindings- [ ] **TLS**: Endpoints use HTTPS, certificates valid- [ ] **Logging**: Audit trail enabled- [ ] **Secrets Mgmt**: Using vault/external-secrets, not plain env vars## Output1. **Risk Level**: Critical / High / Medium / Low2. **Findings**: Categorized list by severity - For each: file, line, description, remediation command3. **OWASP Top 10**: Which risks apply to this project4. **Remediation**: Specific command or change for each finding5. **Compliance**: Status vs frameworks (SOC2, HIPAA, PCI-DSS basics)

Frequently asked questions

Security Scan