# Safety Scan

> Active Security Enforcement. Scans code for vulnerabilities (SAST), secrets (Gitleaks), and insecure dependencies (SCA) before commit/deployment.

- Skill: `majiayu000/safety-scan` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/safety-scan`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/safety-scan/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/safety-scan

---


# Safety Scan Skill

## Goal
Prevent "Insecure Code" from entering the codebase by strictly enforcing security checks.

## Flow

### 1. Credentials Check (Gitleaks)
**Command**: `gitleaks detect --source . -v` (or regex fallback)
**Check**: Are there API Keys, Tokens, or Passwords in the diff?
*   *If Found*: **BLOCK COMMIT**. Auto-delete or `.gitignore` the secret. Alert Human.

### 2. Static Analysis (SAST)
**Command**: `semgrep scan --config=p/security-audit` (if installed) OR `npm audit` / `pip-audit`.
**Check**: High-Severity vulnerabilities (RCE, SQLi, XSS).
*   *If Found*: **BLOCK COMMIT**. Invoke `ci-autofix` to patch.

### 3. Logic & PII Check
**Action**: LLM Review of the diff.
*   "Does this code log User PII?"
*   "Does this code execute arbitrary system commands (`exec`, `eval`)?"
*   *If Risky*: Add `# TODO: SECURITY REVIEW` comment and flag in `project/tasks.md`.

## Output
*   **PASS**: "No critical issues found."
*   **FAIL**: "Blocking Commit. Found [N] Issues."