Source Code Scanning
Security-focused source code review and SAST.
Install
npx skills add transilienceai/communitytools --skill source-code-scanning -g -a claude-code -y- Repository
- transilienceai/communitytools600
- Category
- Security
- Updated
- 3mo ago
- License
- MIT
- Context cost
- Lightabout 1,060 tokens
- Runs scripts
- No, instructions only
What it does
Security-focused source code review and SAST. Scans for vulnerabilities (OWASP Top 10, CWE Top 25), CVEs in third-party dependencies/packages, hardcoded secrets, malicious code, and insecure patterns. Use when given source code, a repo path, or asked to "audit", "scan", "review" code security, or "check dependencies for CVEs".
Source Code Security Review
Quick Start
- Identify - languages, frameworks, package managers present
- Automated SAST - run tools appropriate to the stack
- Dependency CVEs - scan lockfiles/manifests for known CVEs
- Secrets scan - detect hardcoded credentials/tokens
- Manual review - trace high-risk sinks (exec, eval, query, deserialize)
- Malicious code - check for backdoors, obfuscation, suspicious network calls
- Report - findings with CWE/CVE refs, severity, PoC, remediation
Workflow
Phase 1: Enumerate
- Languages: ls **/*.{py,js,ts,java,go,rb,php,cs,rs}
- Packages: find package.json, requirements.txt, go.mod, pom.xml, Gemfile, composer.json, Cargo.toml
- Entry points: main(), index.*, app.*, server.*
- Config files: .env*, config.*, settings.*, *.yaml, *.toml
Phase 2: Automated SAST
See sast-tools.md for commands per language.
Key tools:
- Multi-language: Semgrep (
semgrep --config=auto .) - Python: Bandit (
bandit -r . -f json) - JavaScript/TS: ESLint security plugin, njsscan
- Java: SpotBugs + FindSecBugs
- Go: gosec (
gosec ./...) - PHP: PHPCS Security Audit
- Ruby: Brakeman (
brakeman -o report.json) - All: CodeQL (via
gh codeql)
Phase 3: Dependency CVE Scan
See dependency-cve-scanning.md for commands.
| Ecosystem | Command |
|---|---|
| npm/yarn | npm audit --json / yarn audit |
| Python | pip-audit -r requirements.txt |
| Java | dependency-check --scan . |
| Go | govulncheck ./... |
| Ruby | bundle audit |
| Generic | trivy fs . / grype dir:. |
Phase 4: Secrets Detection
See secrets-detection.md.
trufflehog filesystem . --json
gitleaks detect --source . -v
