# Source Code Scanning

Security-focused source code review and SAST.

- Repository: https://github.com/transilienceai/communitytools (600 stars)
- Category: Security
- License: MIT
- Last updated: 2026-07-29
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add transilienceai/communitytools --skill source-code-scanning -g -a claude-code -y`
Codex: `npx skills add transilienceai/communitytools --skill source-code-scanning -g -a codex -y`
Cursor: `npx skills add transilienceai/communitytools --skill source-code-scanning -g -a cursor -y`
Gemini CLI: `npx skills add transilienceai/communitytools --skill source-code-scanning -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add transilienceai/communitytools`

## Description

Security-focused source code review and SAST. Scans for vulnerabilities (OWASP Top 10, CWE Top 25), CVEs in third-party dependencies/packages, hardcoded secrets, malicious code, and insecure patterns. Use when given source code, a repo path, or asked to "audit", "scan", "review" code security, or "check dependencies for CVEs".

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Source Code Security Review

## Quick Start

1. **Identify** - languages, frameworks, package managers present
2. **Automated SAST** - run tools appropriate to the stack
3. **Dependency CVEs** - scan lockfiles/manifests for known CVEs
4. **Secrets scan** - detect hardcoded credentials/tokens
5. **Manual review** - trace high-risk sinks (exec, eval, query, deserialize)
6. **Malicious code** - check for backdoors, obfuscation, suspicious network calls
7. **Report** - findings with CWE/CVE refs, severity, PoC, remediation

## Workflow

### Phase 1: Enumerate
```
- Languages: ls **/*.{py,js,ts,java,go,rb,php,cs,rs}
- Packages: find package.json, requirements.txt, go.mod, pom.xml, Gemfile, composer.json, Cargo.toml
- Entry points: main(), index.*, app.*, server.*
- Config files: .env*, config.*, settings.*, *.yaml, *.toml
```

### Phase 2: Automated SAST
See [sast-tools.md](reference/sast-tools.md) for commands per language.

Key tools:
- **Multi-language**: Semgrep (`semgrep --config=auto .`)
- **Python**: Bandit (`bandit -r . -f json`)
- **JavaScript/TS**: ESLint security plugin, njsscan
- **Java**: SpotBugs + FindSecBugs
- **Go**: gosec (`gosec ./...`)
- **PHP**: PHPCS Security Audit
- **Ruby**: Brakeman (`brakeman -o report.json`)
- **All**: CodeQL (via `gh codeql`)

### Phase 3: Dependency CVE Scan
See [dependency-cve-scanning.md](reference/dependency-cve-scanning.md) for commands.

| Ecosystem | Command |
|---|---|
| npm/yarn | `npm audit --json` / `yarn audit` |
| Python | `pip-audit -r requirements.txt` |
| Java | `dependency-check --scan .` |
| Go | `govulncheck ./...` |
| Ruby | `bundle audit` |
| Generic | `trivy fs .` / `grype dir:.` |

### Phase 4: Secrets Detection
See [secrets-detection.md](reference/secrets-detection.md).
```bash
trufflehog filesystem . --json
gitleaks detect --source . -v
```

The rest: https://github.com/transilienceai/communitytools/blob/HEAD/skills/source-code-scanning/SKILL.md