# Vulnerability Scanner

> Scans code for security vulnerabilities, identifies CVE patterns, and provides severity ratings with remediation guidance. Use when scanning for security issues, code vulnerabilities, or OWASP top 10 problems. Use when this capability is needed.

- Skill: `tomevault-io/vulnerability-scanner-2` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/vulnerability-scanner-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/vulnerability-scanner-2/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/vulnerability-scanner-2

---


# Vulnerability Scanner

## Quick Start

Scan a codebase for common vulnerabilities:

```bash
# For JavaScript/TypeScript
npx eslint --plugin security .

# For Python
bandit -r . -f json

# For general patterns
grep -rn "eval\|exec\|system\|shell" --include="*.py" --include="*.js"
```

## Instructions

### Step 1: Identify Project Type

Detect the technology stack:
- Check for `package.json` (Node.js)
- Check for `requirements.txt` or `pyproject.toml` (Python)
- Check for `go.mod` (Go)
- Check for `Cargo.toml` (Rust)

### Step 2: Run Static Analysis

**JavaScript/TypeScript:**
```bash
npx eslint --plugin security --ext .js,.ts,.jsx,.tsx .
```

**Python:**
```bash
pip install bandit
bandit -r . -f json -o bandit-report.json
```

**Go:**
```bash
go install golang.org/x/vuln/cmd/govulncheck@latest
govulncheck ./...
```

### Step 3: Check for Common Patterns

Scan for dangerous patterns:

| Pattern | Risk | Languages |
|---------|------|-----------|
| `eval()` | Code injection | JS, Python |
| `exec()` | Command injection | Python |
| `shell=True` | Command injection | Python |
| `dangerouslySetInnerHTML` | XSS | React |
| SQL string concatenation | SQL injection | All |
| `pickle.loads()` | Deserialization | Python |

### Step 4: Categorize Findings

Assign severity based on:
- **Critical**: Remote code execution, authentication bypass
- **High**: SQL injection, XSS, SSRF
- **Medium**: Information disclosure, CSRF
- **Low**: Missing headers, verbose errors

### Step 5: Generate Report

Format findings:
```
## Security Scan Results

### Critical (0)
[None found]

### High (2)
1. **SQL Injection** - src/db/queries.js:45
   - Pattern: String concatenation in SQL query
   - Fix: Use parameterized queries

2. **XSS Vulnerability** - src/components/Comment.jsx:23
   - Pattern: dangerouslySetInnerHTML with user input
   - Fix: Sanitize input with DOMPurify
```

## Common Vulnerability Patterns

### Injection Flaws

```javascript
// BAD: SQL Injection
const query = `SELECT * FROM users WHERE id = ${userId}`;

// GOOD: Parameterized query
const query = 'SELECT * FROM users WHERE id = ?';
db.query(query, [userId]);
```

### Cross-Site Scripting (XSS)

```javascript
// BAD: Direct HTML insertion
element.innerHTML = userInput;

// GOOD: Text content or sanitization
element.textContent = userInput;
// or
element.innerHTML = DOMPurify.sanitize(userInput);
```

## Advanced

For detailed information, see:
- [CVE Patterns](reference/cve-patterns.md) - Common vulnerability patterns by type
- [Remediation Guide](reference/remediation-guide.md) - Fix strategies for each vulnerability type
- [Tools Reference](reference/tools.md) - Security scanning tools by language

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/armanzeroeight) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-11 -->