Code Vuln Audit
Scan code for security issues: dependency vulnerabilities (npm/pip audit), secret leaks...
Install
npx skills add zebbern/claude-code-guide --skill code-vuln-audit -g -a claude-code -y- Repository
- zebbern/claude-code-guide4.7k
- Category
- Security
- Updated
- 4d ago
- License
- MIT
- Context cost
- Lightabout 1,235 tokens
- Runs scripts
- Yes, review before use
What it does
Scan code for security issues: dependency vulnerabilities (npm/pip audit), secret leaks (regex and entropy analysis), and OWASP anti-patterns like SQL injection, XSS, or command injection. Use when the user mentions security scans, vulnerability detection, secret leaks, API keys, OWASP, npm audit, pip-audit, hardcoded passwords, or code security checks.
code-vuln-audit
A code security scanning tool with three core scanning capabilities:
- Dependency Vulnerability Scanning, Automatically detects known vulnerabilities in npm / pip dependencies
- Secret Leak Detection, Discovers hardcoded secrets, tokens, and passwords via regex matching + Shannon entropy analysis
- OWASP Pattern Detection, Identifies common security anti-patterns such as SQL injection, XSS, command injection, and insecure deserialization
Quick Start
# Scan the current directory (all checks)
python3 scripts/security_scan.py .
# Scan dependencies only
python3 scripts/security_scan.py --mode deps .
# Detect secret leaks only
python3 scripts/security_scan.py --mode secrets /path/to/project
# Detect OWASP security patterns only
python3 scripts/security_scan.py --mode owasp .
# Output report in JSON format
python3 scripts/security_scan.py --format json --output report.json .
# Only show findings at high severity and above
python3 scripts/security_scan.py --severity high .
Scan Module Details
1. Dependency Vulnerability Scanning (deps)
Automatically detects the project type and invokes the appropriate tool:
| Project Type | Detection File | Tool Used |
|---|---|---|
| Node.js | package.json + package-lock.json | npm audit |
| Python | requirements.txt / pyproject.toml / Pipfile | pip-audit |
If the corresponding audit tool is not installed, a helpful message is displayed instead of an error.
2. Secret Leak Detection (secrets)
Detection is performed in two ways:
Regex Matching: Covers common secret formats
