Navinspire-ia Vulnerability Scanner
Overview
Focused flaw hunting: unlike a broad security audit, this skill targets specific exploitable weaknesses with proof. Every finding needs a location, a reproduction sketch, and the minimal patch. Read-only by default.
Scan targets
| Class | What to grep / check |
|---|---|
| Injection | string-built SQL, shell=True, template injection, eval/Function() |
| Secrets | AWS/GCP keys, JWT secrets, API tokens, private keys, DB URLs in code or history |
| Dependencies | lockfile versions vs CVE databases (npm audit, pip-audit, osv-scanner, cargo audit) |
| SSRF | user-supplied URLs passed to fetch/requests/httpx without allowlist |
| Path traversal | user paths joined without normalization + containment check |
| Deserialization | pickle.loads, yaml.load (no SafeLoader), ObjectInputStream |
| XSS | innerHTML, dangerouslySetInnerHTML, unescaped template output |
| Auth flaws | JWT alg:none, missing signature verification, predictable tokens |
| Prompt injection | LLM tools that pass web/file content into system-level instructions |
Workflow
- Call
security_scan(kind=full)(orsast/secrets/scafor a focused Action) before manual greps. - Inventory the stack (languages, frameworks, lockfiles) for any remaining scanners not covered.
- Run extra CLIs via exec when present (
osv-scanner,cargo audit,trivy), then pattern sweeps for what tools miss. - For each hit, verify exploitability: trace the input path, check existing sanitization, confirm the vulnerable version is actually in the dependency tree. Add
malicious_input_examplewhen possible. - Deduplicate and rate: Critical (remote exploit / secret leak), High, Medium, Low.
- Report format per finding:
[SEVERITY] title- file:line- Proof: the code path or dependency chain
- Impact: what an attacker gains
- Fix: the minimal diff or version bump
- End with a summary table and the recommended fix order.
Anti-patterns
- Flagging a vulnerable version that is not actually resolved in the lockfile
- Reporting sanitized inputs as injections
- Copy-pasting scanner output without verification
- Fixing code during the scan without an explicit request