Security Scan Skill
Overview
Run a multi-engine security scan on a target directory or repo and produce a structured vulnerability report.
Inputs
- Target: directory path, GitHub repo URL, or "." for current directory
- Scope: "full" (all engines) or specific engine name
Engines
- Semgrep - SAST rules for Python/JS/TS/Go
- Trivy - Dependency + container + IaC scanning
- osv-scanner - Open-source vulnerability database lookup
- Bandit - Python-specific security linting (if Python code present)
Workflow
- Detect project languages and package managers
- Run applicable scanners in parallel
- Deduplicate findings across engines
- Classify by severity: CRITICAL, HIGH, MEDIUM, LOW
- Map findings to OWASP Top 10 / OWASP LLM Top 10
- Output structured JSON report + human-readable summary
Output Format
{
"scan_id": "uuid",
"target": "path/or/url",
"timestamp": "ISO8601",
"summary": {
"critical": 0,
"high": 2,
"medium": 5,
"low": 12,
"total": 19
},
"findings": [
{
"id": "finding-uuid",
"engine": "semgrep",
"rule": "typescript.express.security.audit.xss",
"severity": "HIGH",
"file": "src/api/handler.ts",
"line": 42,
"title": "Cross-Site Scripting (XSS)",
"description": "User input rendered without sanitization",
"owasp": "A03:2021 Injection",
"fix_available": true,
"estimated_loc": 3
}
]
}
Guardrails
- Read-only: do not modify any scanned files
- Do not execute untrusted code from scanned repos
- Filter out low-confidence results by default
- Report scanner errors separately from findings
1---2name: scan3description: Run a comprehensive security scan on a codebase using available security scanners (Semgrep, Bandit, Trivy, osv-scanner). Returns structured findings with severity, file location, and OWASP mapping.4---56# Security Scan Skill78## Overview910Run a multi-engine security scan on a target directory or repo and produce a structured vulnerability report.1112## Inputs1314- Target: directory path, GitHub repo URL, or "." for current directory15- Scope: "full" (all engines) or specific engine name1617## Engines18191. **Semgrep** - SAST rules for Python/JS/TS/Go202. **Trivy** - Dependency + container + IaC scanning213. **osv-scanner** - Open-source vulnerability database lookup224. **Bandit** - Python-specific security linting (if Python code present)2324## Workflow25261. Detect project languages and package managers272. Run applicable scanners in parallel283. Deduplicate findings across engines294. Classify by severity: CRITICAL, HIGH, MEDIUM, LOW305. Map findings to OWASP Top 10 / OWASP LLM Top 10316. Output structured JSON report + human-readable summary3233## Output Format3435```json36{37 "scan_id": "uuid",38 "target": "path/or/url",39 "timestamp": "ISO8601",40 "summary": {41 "critical": 0,42 "high": 2,43 "medium": 5,44 "low": 12,45 "total": 1946 },47 "findings": [48 {49 "id": "finding-uuid",50 "engine": "semgrep",51 "rule": "typescript.express.security.audit.xss",52 "severity": "HIGH",53 "file": "src/api/handler.ts",54 "line": 42,55 "title": "Cross-Site Scripting (XSS)",56 "description": "User input rendered without sanitization",57 "owasp": "A03:2021 Injection",58 "fix_available": true,59 "estimated_loc": 360 }61 ]62}63```6465## Guardrails6667- Read-only: do not modify any scanned files68- Do not execute untrusted code from scanned repos69- Filter out low-confidence results by default70- Report scanner errors separately from findings
jiayaoqijia