How do I install the Security Scanner skill?

Run npx skillmds@latest add zedarvates/security-scanner in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Security Scanner safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Security Scanner?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Security Scanner free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Security Scanner?

zedarvates (@zedarvates) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Security Scanner by zedarvates — Agent Skill

Name: Security Scanner
Author: zedarvates

Security Scanner

Scan Python skills and MCP servers for malicious code — dangerous imports, network exfiltration, filesystem abuse, subprocess injection, obfuscation, crypto weakness, environment leaks, and supply-chain attacks. Use when auditing code for security, running pre-commit hooks, or preparing CI/CD security gates.

zedarvates 7360ba6 10 files · 49.1 KB Updated Sep 17, 2026

File contents

security_scanner — code security scanner

Détecte les patterns malveillants dans les skills Python, MCP servers, et pipelines. Combinaison de regex pattern-matching et d'analyse AST Python. Pour les signaux critiques d'exécution, le scanner vérifie aussi le contexte lexical Python : une signature dans une chaîne, docstring ou commentaire ne déclenche pas d'alerte d'exécution.

Usage

# Scanner un dossier
python -m skills.security_scanner.cli scan skills/ --fail-on critical
python -m skills.security_scanner.cli scan . --format json
python -m skills.security_scanner.cli scan src/main.py --verbose

# Audit complet
python -m skills.security_scanner.cli audit skills/ --format compact

Checks effectués

Check	Regex	AST	Exemple
`dangerous_imports`	✅	✅	`eval(user_input)`, `exec(code)`
`network_exfil`	✅	✅	`requests.post("evil.com")`
`filesystem_abuse`	✅	✅	`open("/etc/passwd", "w")`
`subprocess_injection`	✅	✅	`shell=True` avec input concaténé
`obfuscation`	✅	❌	`base64.b64decode`, `bytes([...]).decode()`
`crypto_weak`	✅	❌	`RSA.generate(512)`, `MD5`
`env_leak`	✅	✅	`print(os.environ["SECRET"])`
`supply_chain`	✅	❌	Imports de packages inconnus

Architecture

security_scanner/
├── scanner.py     # Orchestrateur : itère fichiers, appelle analyseurs
├── patterns.py    # Base de patterns (regex + metadata)
├── ast_checker.py # Analyse Python AST
├── report.py      # Compilation du rapport
├── rules/         # YAML rules extensibles
├── cli.py         # CLI argparse
└── test_security_scanner.py

Intégration

# Pre-commit hook
python -m skills.security_scanner.cli scan . --fail-on critical --format compact

# CI/CD
python -m skills.security_scanner.cli scan skills/ --format json --output security-report.json

# Nightly audit
python -m skills.security_scanner.cli audit . --format markdown

Pitfalls

Faux positifs — eval dans un contexte contrôlé (ex: eval("1+1")) est signalé. L'AST checker permet de filtrer les évaluations statiques.
Fichiers binaires — Skip automatique (.pyc, .so, .dll, images).
Dossiers ignorés — .git, node_modules, pycache, .venv.
Performance — Utilise concurrent.futures pour scanner en parallèle.

---name: security-scannerdescription: Scan Python skills and MCP servers for malicious code — dangerous imports, network exfiltration, filesystem abuse, subprocess injection, obfuscation, crypto weakness, environment leaks, and supply-chain attacks. Use when auditing code for security, running pre-commit hooks, or preparing CI/CD security gates.---# security_scanner — code security scannerDétecte les patterns malveillants dans les skills Python, MCP servers, et pipelines.Combinaison de regex pattern-matching et d'analyse AST Python.Pour les signaux critiques d'exécution, le scanner vérifie aussi le contextelexical Python : une signature dans une chaîne, docstring ou commentaire nedéclenche pas d'alerte d'exécution.## Usage```bash# Scanner un dossierpython -m skills.security_scanner.cli scan skills/ --fail-on criticalpython -m skills.security_scanner.cli scan . --format jsonpython -m skills.security_scanner.cli scan src/main.py --verbose# Audit completpython -m skills.security_scanner.cli audit skills/ --format compact```## Checks effectués| Check | Regex | AST | Exemple ||-------|-------|-----|---------|| `dangerous_imports` | ✅ | ✅ | `eval(user_input)`, `exec(code)` || `network_exfil` | ✅ | ✅ | `requests.post("evil.com")` || `filesystem_abuse` | ✅ | ✅ | `open("/etc/passwd", "w")` || `subprocess_injection` | ✅ | ✅ | `shell=True` avec input concaténé || `obfuscation` | ✅ | ❌ | `base64.b64decode`, `bytes([...]).decode()` || `crypto_weak` | ✅ | ❌ | `RSA.generate(512)`, `MD5` || `env_leak` | ✅ | ✅ | `print(os.environ["SECRET"])` || `supply_chain` | ✅ | ❌ | Imports de packages inconnus |## Architecture```security_scanner/├── scanner.py # Orchestrateur : itère fichiers, appelle analyseurs├── patterns.py # Base de patterns (regex + metadata)├── ast_checker.py # Analyse Python AST├── report.py # Compilation du rapport├── rules/ # YAML rules extensibles├── cli.py # CLI argparse└── test_security_scanner.py```## Intégration```bash# Pre-commit hookpython -m skills.security_scanner.cli scan . --fail-on critical --format compact# CI/CDpython -m skills.security_scanner.cli scan skills/ --format json --output security-report.json# Nightly auditpython -m skills.security_scanner.cli audit . --format markdown```## Pitfalls1. **Faux positifs** — `eval` dans un contexte contrôlé (ex: `eval("1+1")`) est signalé. L'AST checker permet de filtrer les évaluations statiques.2. **Fichiers binaires** — Skip automatique (.pyc, .so, .dll, images).3. **Dossiers ignorés** — .git, node_modules, __pycache__, .venv.4. **Performance** — Utilise `concurrent.futures` pour scanner en parallèle.

Frequently asked questions