Security Scan

Security Scan

Proactive vulnerability detection for common security issues before PR submission.

Triggers

When to Use

Use this skill when:

• Preparing code for PR submission (catch issues before review)
• Working with file path handling (user input to file operations)
• Building shell commands dynamically
• Integrating pre-commit security gates

Use security-detection instead when:

• Determining if a file needs security review (path-based routing)
• Triggering security agent involvement based on file types

Use codeql-scan instead when:

• Running comprehensive SAST analysis (30-60s full scan)
• Need deep data flow analysis beyond pattern matching
• CI pipeline integration requiring SARIF output

Use threat-modeling instead when:

• Performing design-level security analysis
• Creating STRIDE threat matrices
• Strategic security architecture review

Quick Reference

Available Scripts

Usage

Basic Scan (Staged Files)

python .claude/skills/security-scan/scripts/scan_vulnerabilities.py --git-staged

Scan Specific Files

python .claude/skills/security-scan/scripts/scan_vulnerabilities.py path/to/file.py another/script.ps1

Scan Directory

python .claude/skills/security-scan/scripts/scan_vulnerabilities.py --directory src/

JSON Output (CI Integration)

python .claude/skills/security-scan/scripts/scan_vulnerabilities.py --git-staged --format json

Specific CWE Focus

# Path traversal only
python .claude/skills/security-scan/scripts/scan_vulnerabilities.py --cwe 22 --git-staged

# Command injection only
python .claude/skills/security-scan/scripts/scan_vulnerabilities.py --cwe 78 --git-staged

Output

Console Output (Default)

When vulnerabilities are detected, the scanner outputs findings with file location, pattern matched, and severity. Each finding includes the specific code line and a recommendation for remediation.

JSON Output (CI Mode)

Machine-readable JSON format including scan timestamp, files scanned, vulnerability details (CWE, file, line, code, severity, recommendation), and summary statistics.

Exit Codes

Detected Patterns

CWE-22: Path Traversal

Detection Heuristics:

• Variable names suggesting user input: user*, input*, param*, arg*, request*
• Missing validation patterns before file operations
• Absence of .. traversal checks
• Missing path canonicalization

CWE-78: Command Injection

Detection Heuristics:

• String interpolation/concatenation in command construction
• shell=True in subprocess calls
• Unquoted variable expansion in shell scripts
• Dynamic command building from external input

Integration

Pre-commit Hook

Add to .githooks/pre-commit to run security scan before commits (blocking mode).

CI Integration

Add a workflow step to run the scanner with JSON output and upload results as artifacts.

Workflow Integration

Recommended workflow order:

1. security-detection: Identify if security-relevant files changed
2. security-scan: Scan code content for CWE patterns (THIS SKILL)
3. codeql-scan: Full SAST analysis (if security-scan finds issues or high-risk files)
4. security agent: Deep review of flagged vulnerabilities

Process

                        Security Scan Workflow
                        ======================

     ┌─────────────────┐
     │  Collect Files  │ <- --git-staged, --directory, or explicit paths
     └────────┬────────┘
              │
              ▼
     ┌─────────────────┐
     │ Detect Language │ <- .py, .ps1, .sh, .cs, .bash
     └────────┬────────┘
              │
              ▼
     ┌─────────────────┐
     │ Apply CWE-22    │ <- Path traversal patterns by language
     │ Patterns        │
     └────────┬────────┘
              │
              ▼
     ┌─────────────────┐
     │ Apply CWE-78    │ <- Command injection patterns by language
     │ Patterns        │
     └────────┬────────┘
              │
              ▼
     ┌─────────────────┐
     │ Aggregate       │ <- Deduplicate, sort by severity
     │ Findings        │
     └────────┬────────┘
              │
              ▼
     ┌─────────────────┐
     │ Output Results  │ <- Console or JSON format
     └─────────────────┘

Anti-Patterns

Suppression

To suppress false positives, add inline comments with justification:

# security-scan: ignore CWE-22 - path validated by validate_upload_path()

Suppressions are tracked in scan output for audit purposes.

Verification

After running security scan:

• All HIGH/CRITICAL findings addressed or documented
• No path traversal patterns with user input
• No command injection patterns with dynamic input
• Variables quoted in shell scripts
• Input validation present before file/command operations
• Suppressions documented with justification

Related Skills

References

• CWE-22: Path Traversal
• CWE-78: OS Command Injection
• OWASP Command Injection
• Path Traversal Research (2025)
• Analysis: .agents/analysis/closed-pr-reviewer-patterns-2026-02-08.md

Extension Points

Converted and distributed by TomeVault — claim your Tome and manage your conversions.