# Scan

> Run a security scan on the codebase using available scanners. Returns structured findings with severity and OWASP mapping.

- Skill: `jiayaoqijia/scan-2` (Agent Skill)
- Install (CLI): `npx skillmds@latest add jiayaoqijia/scan-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/jiayaoqijia/scan-2/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: jiayaoqijia (https://skillmd.com/u/jiayaoqijia)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/jiayaoqijia/scan-2

---


# Security Scan Skill

## Overview

Run a multi-engine security scan on a target directory and produce a structured vulnerability report.

## Engines

1. **Semgrep** - SAST rules for JS/TS
2. **Trivy** - Dependency + container scanning

## Workflow

1. Detect project languages and package managers
2. Run applicable scanners
3. Classify by severity: CRITICAL, HIGH, MEDIUM, LOW
4. Map findings to OWASP Top 10
5. Output structured report

## Guardrails

- Read-only: do not modify any scanned files
- Filter out low-confidence results by default