# Security Scan

> Defensive review checklist for secrets, auth boundaries, input validation, and package safety.

- Skill: `ldilov/security-scan` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add ldilov/security-scan`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ldilov/security-scan/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: ldilov (https://skillmd.com/u/ldilov)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/ldilov/security-scan

---


# Security Scan

## Trigger Signals

- the task touches auth, secrets, privileged routes, or network boundaries
- the repository is a service or security-sensitive runtime

## Inspect First

- environment and config surfaces
- auth middleware, handlers, route guards, and secret-loading code
- dependency manifests and externally reachable entrypoints

## Workflow

1. identify exposed trust boundaries and secret-bearing paths
2. inspect input validation, auth, and authorization behavior
3. review dependency, logging, and data-exposure risks
4. summarize concrete findings and remediation priorities

## Output Contract

- attack-surface summary
- ordered findings with severity
- recommended remediations
- residual risk note

## Failure Modes

- the task scope hides the actual runtime boundary
- there is no reliable way to trace user input to protected operations

## Escalation

- escalate when a likely secret leak or auth bypass is detected
- escalate when the scan cannot safely verify a high-risk boundary

## References

- `skills/security-scan/references/review-checklist.md`