# Security Scanner

> Automated security scanning for hardcoded secrets, insecure file permissions, vulnerable dependencies, and unsafe code patterns

- Skill: `lodetomasi/security-scanner` (Agent Skill)
- Install (CLI): `npx skillmds@latest add lodetomasi/security-scanner`
- Raw SKILL.md: https://api.skillmd.com/api/skills/lodetomasi/security-scanner/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: lodetomasi (https://skillmd.com/u/lodetomasi)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/lodetomasi/security-scanner

---


# Security Scanner

## Overview
Comprehensive security scanning tool that checks for hardcoded secrets, insecure file permissions, vulnerable Python dependencies, unsafe bash script patterns, and insecure Python code patterns in repositories.

## When to Use
- Before committing code to version control
- During pull request reviews
- As part of CI/CD pipeline security gates
- Regular security audits (weekly/monthly)
- After adding new dependencies
- When onboarding new projects

## Security Checks

### 1. Secrets & Credentials Detection
**Patterns Checked**:
- Hardcoded passwords
- API keys (10+ characters)
- Secret tokens
- AWS access keys
- Private keys (PEM format)

**Example Detections**:
```python
# ❌ Will be flagged
password = "MySecretPass123"
api_key = "sk_live_abc123def456"
AWS_SECRET_ACCESS_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCY"
```

### 2. File Permissions Check
- World-writable files (permissions 002)
- Executable files that shouldn't be
- Configuration files with overly permissive access

### 3. Python Dependency Vulnerabilities
**Tools Used**:
- **pip-audit**: Scan requirements.txt for known CVEs
- **safety**: Additional vulnerability database

**Detects**:
- Packages with known security issues
- Outdated versions with patches available
- Severity levels (Critical, High, Medium, Low)

### 4. Unsafe Bash Script Patterns
**Dangerous Patterns**:
- `eval $variable` - Code injection risk
- `curl | bash` - Remote code execution
- `rm -rf /` - Destructive commands
- Unquoted variables in dangerous contexts

### 5. Insecure Python Code Patterns
**Patterns Checked**:
- `import pickle` - Unsafe deserialization
- `eval()` / `exec()` - Code injection
- `shell=True` in subprocess - Command injection
- Bare `assert` statements - Can be disabled
- `input()` with `exec` - Direct code execution

## Usage

### Basic Scan

```bash
./claude/skills/security-scanner/security-scanner.sh .
```

### Scan Specific Directory

```bash
./claude/skills/security-scanner/security-scanner.sh /path/to/project
```

### Review Generated Report

```bash
cat security-reports/security_report_YYYYMMDD_HHMMSS.txt
```

## Sample Output

```
╔════════════════════════════════════════════════════════════════╗
║           SECURITY SCANNER - Skills & Tools Repository        ║
╚════════════════════════════════════════════════════════════════╝

Target: /Users/user/project
Timestamp: 2025-01-15 14:30:00

[1/6] Checking for secrets and credentials...
⚠️  Found potential API key at config.py:15
⚠️  Found hardcoded password at setup.py:42
✗ Found 2 potential secrets!
  Review the above matches and remove any hardcoded credentials

[2/6] Checking file permissions...
✓ File permissions look good

[3/6] Checking Python dependencies...
Running pip-audit...
⚠️  requests==2.25.1 has known vulnerability (CVE-2023-32681)
    Upgrade to: 2.31.0

[4/6] Checking bash scripts for security issues...
✗ deploy.sh: Uses 'eval' with variables (dangerous)
✗ install.sh: Pipes curl to bash (dangerous)

[5/6] Checking Python files for insecure patterns...
⚠️  Found potentially unsafe pattern: shell=True
  utils/backup.py:34: subprocess.call(..., shell=True)

[6/6] Generating security report...
✓ Report saved to: security-reports/security_report_20250115_143000.txt

╔════════════════════════════════════════════════════════════════╗
║                      SCAN COMPLETE                             ║
╚════════════════════════════════════════════════════════════════╝
```

## Security Report Contents

The generated report includes:
- Executive summary
- Detailed findings by category
- Recommendations for each issue
- Next steps and remediation guidance
- Links to security best practices

## Common Issues & Fixes

### Hardcoded Secrets
```python
# ❌ BAD
API_KEY = "sk_live_abc123"

# ✅ GOOD
import os
API_KEY = os.environ.get('API_KEY')
```

### Subprocess with shell=True
```python
# ❌ BAD
subprocess.run(f"ls {user_input}", shell=True)

# ✅ GOOD
subprocess.run(["ls", user_input], shell=False)
```

### Dangerous Bash Commands
```bash
# ❌ BAD
eval "$user_command"
curl https://example.com/script.sh | bash

# ✅ GOOD
# Validate input first
if [[ "$user_command" =~ ^[a-zA-Z0-9_-]+$ ]]; then
    "$user_command"
fi
```

### Insecure File Permissions
```bash
# ❌ BAD: World-writable
chmod 666 config.json

# ✅ GOOD: Owner read/write only
chmod 600 config.json
```

## CI/CD Integration

### GitHub Actions
```yaml
name: Security Scan

on: [push, pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Install dependencies
        run: |
          pip install pip-audit safety

      - name: Run Security Scanner
        run: |
          chmod +x .claude/skills/security-scanner/security-scanner.sh
          ./.claude/skills/security-scanner/security-scanner.sh .

      - name: Upload Security Report
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: security-report
          path: security-reports/
```

### GitLab CI
```yaml
security_scan:
  stage: test
  script:
    - pip install pip-audit safety
    - chmod +x .claude/skills/security-scanner/security-scanner.sh
    - ./.claude/skills/security-scanner/security-scanner.sh .
  artifacts:
    paths:
      - security-reports/
    when: always
```

## Exclusions & False Positives

### Exclude Directories
Edit the script to add exclusions:
```bash
# Add to grep commands:
--exclude-dir=venv \
--exclude-dir=node_modules \
--exclude-dir=.git \
--exclude-dir=dist
```

### Suppress Specific Warnings
Document accepted risks in security-exceptions.txt:
```
# Accepted security exceptions
config.py:15 - API key in test configuration (not production)
utils/backup.py:34 - shell=True needed for wildcard expansion (input sanitized)
```

## Security Best Practices

1. **Never commit secrets** - Use environment variables
2. **Scan before commit** - Pre-commit hooks
3. **Regular dependency updates** - Weekly checks
4. **Review all HIGH/CRITICAL** - Within 24 hours
5. **Document exceptions** - Why risks are accepted
6. **Automated scanning** - CI/CD integration
7. **Security training** - Educate developers
8. **Principle of least privilege** - Minimal file permissions
9. **Input validation** - Never trust user input
10. **Defense in depth** - Multiple security layers

## Additional Security Tools

For comprehensive security:
- **SAST Analyzer skill**: Deep static analysis with Semgrep
- **DAST Scanner skill**: Runtime testing
- **Dependency Checker skill**: Advanced SCA
- **Penetration Tester skill**: Authorized security testing

## Requirements

```bash
# Python tools
pip install pip-audit safety

# Bash (built-in on Unix/macOS/Linux)
```

## Scan Frequency Recommendations

- **Pre-commit**: Every commit (via git hooks)
- **CI/CD**: Every push to repository
- **Scheduled**: Weekly full scans
- **After changes**: Dependency updates, major features
- **Quarterly**: Comprehensive security audit

## Exit Codes

The scanner always returns 0 (success) but reports issues in the output and report file. Review the report to determine if action is needed.

## False Positive Handling

If you encounter false positives:
1. Review the flagged code
2. Verify it's actually safe
3. Document why in comments
4. Consider refactoring for clarity
5. Add to exceptions list if necessary

## Support

For security issues or questions:
- Review generated reports carefully
- Check OWASP guidelines
- Consult security team for critical findings
- Update dependencies promptly