Security Scanner

Security Scanner

Overview

Comprehensive security scanning tool that checks for hardcoded secrets, insecure file permissions, vulnerable Python dependencies, unsafe bash script patterns, and insecure Python code patterns in repositories.

When to Use

• Before committing code to version control
• During pull request reviews
• As part of CI/CD pipeline security gates
• Regular security audits (weekly/monthly)
• After adding new dependencies
• When onboarding new projects

Security Checks

1. Secrets & Credentials Detection

Patterns Checked:

• Hardcoded passwords
• API keys (10+ characters)
• Secret tokens
• AWS access keys
• Private keys (PEM format)

Example Detections:

# ❌ Will be flagged
password = "MySecretPass123"
api_key = "sk_live_abc123def456"
AWS_SECRET_ACCESS_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCY"

2. File Permissions Check

• World-writable files (permissions 002)
• Executable files that shouldn't be
• Configuration files with overly permissive access

3. Python Dependency Vulnerabilities

Tools Used:

• pip-audit: Scan requirements.txt for known CVEs
• safety: Additional vulnerability database

Detects:

• Packages with known security issues
• Outdated versions with patches available
• Severity levels (Critical, High, Medium, Low)

4. Unsafe Bash Script Patterns

Dangerous Patterns:

• eval $variable - Code injection risk
• curl | bash - Remote code execution
• rm -rf / - Destructive commands
• Unquoted variables in dangerous contexts

5. Insecure Python Code Patterns

Patterns Checked:

• import pickle - Unsafe deserialization
• eval() / exec() - Code injection
• shell=True in subprocess - Command injection
• Bare assert statements - Can be disabled
• input() with exec - Direct code execution

Usage

Basic Scan

./claude/skills/security-scanner/security-scanner.sh .

Scan Specific Directory

./claude/skills/security-scanner/security-scanner.sh /path/to/project

Review Generated Report

cat security-reports/security_report_YYYYMMDD_HHMMSS.txt

Sample Output

╔════════════════════════════════════════════════════════════════╗
║           SECURITY SCANNER - Skills & Tools Repository        ║
╚════════════════════════════════════════════════════════════════╝

Target: /Users/user/project
Timestamp: 2025-01-15 14:30:00

[1/6] Checking for secrets and credentials...
⚠️  Found potential API key at config.py:15
⚠️  Found hardcoded password at setup.py:42
✗ Found 2 potential secrets!
  Review the above matches and remove any hardcoded credentials

[2/6] Checking file permissions...
✓ File permissions look good

[3/6] Checking Python dependencies...
Running pip-audit...
⚠️  requests==2.25.1 has known vulnerability (CVE-2023-32681)
    Upgrade to: 2.31.0

[4/6] Checking bash scripts for security issues...
✗ deploy.sh: Uses 'eval' with variables (dangerous)
✗ install.sh: Pipes curl to bash (dangerous)

[5/6] Checking Python files for insecure patterns...
⚠️  Found potentially unsafe pattern: shell=True
  utils/backup.py:34: subprocess.call(..., shell=True)

[6/6] Generating security report...
✓ Report saved to: security-reports/security_report_20250115_143000.txt

╔════════════════════════════════════════════════════════════════╗
║                      SCAN COMPLETE                             ║
╚════════════════════════════════════════════════════════════════╝

Security Report Contents

The generated report includes:

• Executive summary
• Detailed findings by category
• Recommendations for each issue
• Next steps and remediation guidance
• Links to security best practices

Common Issues & Fixes

Hardcoded Secrets

# ❌ BAD
API_KEY = "sk_live_abc123"

# ✅ GOOD
import os
API_KEY = os.environ.get('API_KEY')

Subprocess with shell=True

# ❌ BAD
subprocess.run(f"ls {user_input}", shell=True)

# ✅ GOOD
subprocess.run(["ls", user_input], shell=False)

Dangerous Bash Commands

# ❌ BAD
eval "$user_command"
curl https://example.com/script.sh | bash

# ✅ GOOD
# Validate input first
if [[ "$user_command" =~ ^[a-zA-Z0-9_-]+$ ]]; then
    "$user_command"
fi

Insecure File Permissions

# ❌ BAD: World-writable
chmod 666 config.json

# ✅ GOOD: Owner read/write only
chmod 600 config.json

CI/CD Integration

GitHub Actions

name: Security Scan

on: [push, pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Install dependencies
        run: |
          pip install pip-audit safety

      - name: Run Security Scanner
        run: |
          chmod +x .claude/skills/security-scanner/security-scanner.sh
          ./.claude/skills/security-scanner/security-scanner.sh .

      - name: Upload Security Report
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: security-report
          path: security-reports/

GitLab CI

security_scan:
  stage: test
  script:
    - pip install pip-audit safety
    - chmod +x .claude/skills/security-scanner/security-scanner.sh
    - ./.claude/skills/security-scanner/security-scanner.sh .
  artifacts:
    paths:
      - security-reports/
    when: always

Exclusions & False Positives

Exclude Directories

Edit the script to add exclusions:

# Add to grep commands:
--exclude-dir=venv \
--exclude-dir=node_modules \
--exclude-dir=.git \
--exclude-dir=dist

Suppress Specific Warnings

Document accepted risks in security-exceptions.txt:

# Accepted security exceptions
config.py:15 - API key in test configuration (not production)
utils/backup.py:34 - shell=True needed for wildcard expansion (input sanitized)

Security Best Practices

1. Never commit secrets - Use environment variables
2. Scan before commit - Pre-commit hooks
3. Regular dependency updates - Weekly checks
4. Review all HIGH/CRITICAL - Within 24 hours
5. Document exceptions - Why risks are accepted
6. Automated scanning - CI/CD integration
7. Security training - Educate developers
8. Principle of least privilege - Minimal file permissions
9. Input validation - Never trust user input
10. Defense in depth - Multiple security layers

Additional Security Tools

For comprehensive security:

• SAST Analyzer skill: Deep static analysis with Semgrep
• DAST Scanner skill: Runtime testing
• Dependency Checker skill: Advanced SCA
• Penetration Tester skill: Authorized security testing

Requirements

# Python tools
pip install pip-audit safety

# Bash (built-in on Unix/macOS/Linux)

Scan Frequency Recommendations

• Pre-commit: Every commit (via git hooks)
• CI/CD: Every push to repository
• Scheduled: Weekly full scans
• After changes: Dependency updates, major features
• Quarterly: Comprehensive security audit

Exit Codes

The scanner always returns 0 (success) but reports issues in the output and report file. Review the report to determine if action is needed.

False Positive Handling

If you encounter false positives:

1. Review the flagged code
2. Verify it's actually safe
3. Document why in comments
4. Consider refactoring for clarity
5. Add to exceptions list if necessary

Support

For security issues or questions:

• Review generated reports carefully
• Check OWASP guidelines
• Consult security team for critical findings
• Update dependencies promptly