Vulnerability Scan

Vulnerability Scan

When to Use

Use this skill when tasked with security review, before deploying code, or when auditing an unfamiliar codebase.

Severity Ratings

Finding Output Format

For each finding, produce:

### [SEVERITY] [Short title]
- **Location:** [file:line]
- **Description:** [What the vulnerability is]
- **Risk:** [What an attacker could do]
- **Evidence:** [The specific code or pattern found]
- **Remediation:** [How to fix it]

Procedure

1. Secrets and Credentials

Scan for hardcoded secrets, API keys, tokens, and passwords:

TARGET="${1:-~/workspace}"

echo "=== Scanning for secrets and credentials ==="

# API keys and tokens
rg -n -i '(api[_-]?key|apikey)\s*[:=]' "$TARGET" --type-add 'code:*.{js,py,ts,sh,json,yaml,yml,toml,env}' --type code

# Passwords
rg -n -i '(password|passwd|pwd)\s*[:=]\s*["\x27][^"\x27]' "$TARGET" --type-add 'code:*.{js,py,ts,sh,json,yaml,yml,toml,env}' --type code

# Generic secrets
rg -n -i '(secret|private[_-]?key)\s*[:=]\s*["\x27]' "$TARGET" --type-add 'code:*.{js,py,ts,sh,json,yaml,yml,toml,env}' --type code

# Known token formats
rg -n '(sk-[a-zA-Z0-9]{20,}|ghp_[a-zA-Z0-9]{36}|AKIA[A-Z0-9]{16}|xox[bpas]-[a-zA-Z0-9-]+)' "$TARGET"

# .env files that should not be committed
find "$TARGET" -name '.env' -not -path '*node_modules*' -not -path '*/.git/*' 2>/dev/null

2. Injection Risks

Scan for code injection, SQL injection, and command injection:

echo "=== Scanning for injection risks ==="

# SQL injection — string concatenation in queries
rg -n '(query|execute|sql)\s*\(.*\+.*\)' "$TARGET" --type-add 'code:*.{js,py,ts}' --type code
rg -n 'SELECT.*\+|INSERT.*\+|UPDATE.*\+|DELETE.*\+' "$TARGET" --type-add 'code:*.{js,py,ts}' --type code
rg -n "f['\"].*SELECT|f['\"].*INSERT|f['\"].*UPDATE|f['\"].*DELETE" "$TARGET" --type py

# Command injection — user input in exec/system calls
rg -n '(exec|execSync|spawn|system|popen|subprocess)\s*\(' "$TARGET" --type-add 'code:*.{js,py,ts}' --type code
rg -n 'child_process' "$TARGET" --type js
rg -n 'os\.system|subprocess\.call|subprocess\.run' "$TARGET" --type py

# eval() usage
rg -n '\beval\s*\(' "$TARGET" --type-add 'code:*.{js,py,ts}' --type code

# Path traversal — user input in file paths
rg -n '(readFile|writeFile|open|readdir)\s*\(.*req\.' "$TARGET" --type-add 'code:*.{js,ts}' --type code
rg -n 'open\s*\(.*request\.' "$TARGET" --type py
rg -n '\.\.\/' "$TARGET" --type-add 'code:*.{js,py,ts}' --type code | grep -v node_modules | grep -v '.git'

3. Authentication and Authorization

echo "=== Scanning for auth issues ==="

# Endpoints without auth middleware
rg -n '(app\.(get|post|put|delete|patch)|router\.(get|post|put|delete|patch))' "$TARGET" --type-add 'code:*.{js,ts}' --type code | head -20

# Default credentials
rg -n -i '(admin|root|test|demo|default).*password' "$TARGET" --type-add 'code:*.{js,py,ts,json,yaml,yml}' --type code

# Missing rate limiting
rg -n 'rate.?limit' "$TARGET" --type-add 'code:*.{js,py,ts}' --type code
echo "(If no results above, rate limiting may be missing)"

# JWT issues
rg -n 'algorithm.*none|verify.*false|expiresIn.*[0-9]{5,}' "$TARGET" --type-add 'code:*.{js,py,ts}' --type code

4. Data Exposure

echo "=== Scanning for data exposure ==="

# Sensitive data in logs
rg -n '(console\.log|print|logging\.(info|debug)).*\b(password|token|secret|key|ssn|credit)\b' \
  "$TARGET" --type-add 'code:*.{js,py,ts}' --type code -i

# Verbose error messages in responses
rg -n '(res\.send|res\.json|return.*Response).*\b(stack|trace|error\.message)\b' \
  "$TARGET" --type-add 'code:*.{js,py,ts}' --type code

# Debug mode in production configs
rg -n '(DEBUG\s*=\s*[Tt]rue|debug:\s*true|NODE_ENV.*development)' \
  "$TARGET" --type-add 'code:*.{js,py,ts,json,yaml,yml,env}' --type code

5. Dependency Vulnerabilities

echo "=== Scanning for dependency vulnerabilities ==="

# npm audit
if [ -f "$TARGET/package.json" ]; then
  cd "$TARGET"
  npm audit --json 2>/dev/null | jq '{
    total: .metadata.vulnerabilities,
    critical: [.vulnerabilities | to_entries[] | select(.value.severity == "critical") | .key],
    high: [.vulnerabilities | to_entries[] | select(.value.severity == "high") | .key]
  }' 2>/dev/null || npm audit 2>&1 | tail -20
fi

# pip audit
if [ -f "$TARGET/requirements.txt" ]; then
  cd "$TARGET"
  pip audit 2>&1 | tail -20 || echo "pip-audit not available — install with: pip install pip-audit"
fi

6. Compile Report

REPORT_FILE="/home/shared/security-scan-$(date +%Y%m%d).md"

cat > "$REPORT_FILE" <<'EOF'
# Security Scan Report

**Date:** YYYY-MM-DD
**Target:** [path]
**Scanner:** [agent name]

## Summary
| Severity | Count |
|----------|-------|
| Critical | 0 |
| High | 0 |
| Medium | 0 |
| Low | 0 |
| Info | 0 |

## Findings

### [SEVERITY] [Title]
- **Location:** file:line
- **Description:** ...
- **Risk:** ...
- **Evidence:** `code snippet`
- **Remediation:** ...

## Clean Areas
- [Areas scanned with no findings — confirms coverage]

## Scan Limitations
- [What was NOT covered and why]
EOF

# Register as artifact
bash /home/shared/scripts/artifact.sh register \
  --name "security-scan" \
  --type "report" \
  --path "$REPORT_FILE" \
  --description "Security vulnerability scan report"

Quality Checklist

• All five categories scanned (secrets, injection, auth, data exposure, dependencies)
• Every finding has severity, location, description, risk, and remediation
• No false positives included without noting they need manual verification
• Clean areas documented to show scan coverage
• Limitations explicitly stated (e.g., "no dynamic analysis performed")
• Report written to shared workspace and registered as artifact