# Vulnerability Scan

> Scan source code for security vulnerabilities following OWASP methodology

- Skill: `paulkinlan/vulnerability-scan` (Agent Skill)
- Install (CLI): `npx skillmds@latest add paulkinlan/vulnerability-scan`
- Raw SKILL.md: https://api.skillmd.com/api/skills/paulkinlan/vulnerability-scan/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: paulkinlan (https://skillmd.com/u/paulkinlan)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/paulkinlan/vulnerability-scan

---


# Vulnerability Scan

## When to Use

Use this skill when tasked with security review, before deploying code, or when auditing an unfamiliar codebase.

## Severity Ratings

| Severity | Definition | Examples |
|----------|-----------|----------|
| **Critical** | Exploitable now, data loss or system compromise | Hardcoded credentials, SQL injection, RCE |
| **High** | Likely exploitable, significant impact | Path traversal, missing auth on sensitive endpoint |
| **Medium** | Exploitable under certain conditions | Verbose error messages, weak crypto, SSRF |
| **Low** | Minor risk, defense in depth | Missing rate limiting, overly broad CORS |
| **Info** | Not exploitable but worth noting | Deprecated function usage, missing security headers |

## Finding Output Format

For each finding, produce:

```markdown
### [SEVERITY] [Short title]
- **Location:** [file:line]
- **Description:** [What the vulnerability is]
- **Risk:** [What an attacker could do]
- **Evidence:** [The specific code or pattern found]
- **Remediation:** [How to fix it]
```

## Procedure

### 1. Secrets and Credentials

Scan for hardcoded secrets, API keys, tokens, and passwords:

```bash
TARGET="${1:-~/workspace}"

echo "=== Scanning for secrets and credentials ==="

# API keys and tokens
rg -n -i '(api[_-]?key|apikey)\s*[:=]' "$TARGET" --type-add 'code:*.{js,py,ts,sh,json,yaml,yml,toml,env}' --type code

# Passwords
rg -n -i '(password|passwd|pwd)\s*[:=]\s*["\x27][^"\x27]' "$TARGET" --type-add 'code:*.{js,py,ts,sh,json,yaml,yml,toml,env}' --type code

# Generic secrets
rg -n -i '(secret|private[_-]?key)\s*[:=]\s*["\x27]' "$TARGET" --type-add 'code:*.{js,py,ts,sh,json,yaml,yml,toml,env}' --type code

# Known token formats
rg -n '(sk-[a-zA-Z0-9]{20,}|ghp_[a-zA-Z0-9]{36}|AKIA[A-Z0-9]{16}|xox[bpas]-[a-zA-Z0-9-]+)' "$TARGET"

# .env files that should not be committed
find "$TARGET" -name '.env' -not -path '*node_modules*' -not -path '*/.git/*' 2>/dev/null
```

### 2. Injection Risks

Scan for code injection, SQL injection, and command injection:

```bash
echo "=== Scanning for injection risks ==="

# SQL injection — string concatenation in queries
rg -n '(query|execute|sql)\s*\(.*\+.*\)' "$TARGET" --type-add 'code:*.{js,py,ts}' --type code
rg -n 'SELECT.*\+|INSERT.*\+|UPDATE.*\+|DELETE.*\+' "$TARGET" --type-add 'code:*.{js,py,ts}' --type code
rg -n "f['\"].*SELECT|f['\"].*INSERT|f['\"].*UPDATE|f['\"].*DELETE" "$TARGET" --type py

# Command injection — user input in exec/system calls
rg -n '(exec|execSync|spawn|system|popen|subprocess)\s*\(' "$TARGET" --type-add 'code:*.{js,py,ts}' --type code
rg -n 'child_process' "$TARGET" --type js
rg -n 'os\.system|subprocess\.call|subprocess\.run' "$TARGET" --type py

# eval() usage
rg -n '\beval\s*\(' "$TARGET" --type-add 'code:*.{js,py,ts}' --type code

# Path traversal — user input in file paths
rg -n '(readFile|writeFile|open|readdir)\s*\(.*req\.' "$TARGET" --type-add 'code:*.{js,ts}' --type code
rg -n 'open\s*\(.*request\.' "$TARGET" --type py
rg -n '\.\.\/' "$TARGET" --type-add 'code:*.{js,py,ts}' --type code | grep -v node_modules | grep -v '.git'
```

### 3. Authentication and Authorization

```bash
echo "=== Scanning for auth issues ==="

# Endpoints without auth middleware
rg -n '(app\.(get|post|put|delete|patch)|router\.(get|post|put|delete|patch))' "$TARGET" --type-add 'code:*.{js,ts}' --type code | head -20

# Default credentials
rg -n -i '(admin|root|test|demo|default).*password' "$TARGET" --type-add 'code:*.{js,py,ts,json,yaml,yml}' --type code

# Missing rate limiting
rg -n 'rate.?limit' "$TARGET" --type-add 'code:*.{js,py,ts}' --type code
echo "(If no results above, rate limiting may be missing)"

# JWT issues
rg -n 'algorithm.*none|verify.*false|expiresIn.*[0-9]{5,}' "$TARGET" --type-add 'code:*.{js,py,ts}' --type code
```

### 4. Data Exposure

```bash
echo "=== Scanning for data exposure ==="

# Sensitive data in logs
rg -n '(console\.log|print|logging\.(info|debug)).*\b(password|token|secret|key|ssn|credit)\b' \
  "$TARGET" --type-add 'code:*.{js,py,ts}' --type code -i

# Verbose error messages in responses
rg -n '(res\.send|res\.json|return.*Response).*\b(stack|trace|error\.message)\b' \
  "$TARGET" --type-add 'code:*.{js,py,ts}' --type code

# Debug mode in production configs
rg -n '(DEBUG\s*=\s*[Tt]rue|debug:\s*true|NODE_ENV.*development)' \
  "$TARGET" --type-add 'code:*.{js,py,ts,json,yaml,yml,env}' --type code
```

### 5. Dependency Vulnerabilities

```bash
echo "=== Scanning for dependency vulnerabilities ==="

# npm audit
if [ -f "$TARGET/package.json" ]; then
  cd "$TARGET"
  npm audit --json 2>/dev/null | jq '{
    total: .metadata.vulnerabilities,
    critical: [.vulnerabilities | to_entries[] | select(.value.severity == "critical") | .key],
    high: [.vulnerabilities | to_entries[] | select(.value.severity == "high") | .key]
  }' 2>/dev/null || npm audit 2>&1 | tail -20
fi

# pip audit
if [ -f "$TARGET/requirements.txt" ]; then
  cd "$TARGET"
  pip audit 2>&1 | tail -20 || echo "pip-audit not available — install with: pip install pip-audit"
fi
```

### 6. Compile Report

```bash
REPORT_FILE="/home/shared/security-scan-$(date +%Y%m%d).md"

cat > "$REPORT_FILE" <<'EOF'
# Security Scan Report

**Date:** YYYY-MM-DD
**Target:** [path]
**Scanner:** [agent name]

## Summary
| Severity | Count |
|----------|-------|
| Critical | 0 |
| High | 0 |
| Medium | 0 |
| Low | 0 |
| Info | 0 |

## Findings

### [SEVERITY] [Title]
- **Location:** file:line
- **Description:** ...
- **Risk:** ...
- **Evidence:** `code snippet`
- **Remediation:** ...

## Clean Areas
- [Areas scanned with no findings — confirms coverage]

## Scan Limitations
- [What was NOT covered and why]
EOF

# Register as artifact
bash /home/shared/scripts/artifact.sh register \
  --name "security-scan" \
  --type "report" \
  --path "$REPORT_FILE" \
  --description "Security vulnerability scan report"
```

## Quality Checklist

- [ ] All five categories scanned (secrets, injection, auth, data exposure, dependencies)
- [ ] Every finding has severity, location, description, risk, and remediation
- [ ] No false positives included without noting they need manual verification
- [ ] Clean areas documented to show scan coverage
- [ ] Limitations explicitly stated (e.g., "no dynamic analysis performed")
- [ ] Report written to shared workspace and registered as artifact