# Code Vuln Audit

Scan code for security issues: dependency vulnerabilities (npm/pip audit), secret leaks...

- Repository: https://github.com/zebbern/claude-code-guide (4691 stars)
- Category: Security
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add zebbern/claude-code-guide --skill code-vuln-audit -g -a claude-code -y`
Codex: `npx skills add zebbern/claude-code-guide --skill code-vuln-audit -g -a codex -y`
Cursor: `npx skills add zebbern/claude-code-guide --skill code-vuln-audit -g -a cursor -y`
Gemini CLI: `npx skills add zebbern/claude-code-guide --skill code-vuln-audit -g -a gemini-cli -y`

## Description

Scan code for security issues: dependency vulnerabilities (npm/pip audit), secret leaks (regex and entropy analysis), and OWASP anti-patterns like SQL injection, XSS, or command injection. Use when the user mentions security scans, vulnerability detection, secret leaks, API keys, OWASP, npm audit, pip-audit, hardcoded passwords, or code security checks.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# code-vuln-audit

A code security scanning tool with three core scanning capabilities:

1. **Dependency Vulnerability Scanning**, Automatically detects known vulnerabilities in npm / pip dependencies
2. **Secret Leak Detection**, Discovers hardcoded secrets, tokens, and passwords via regex matching + Shannon entropy analysis
3. **OWASP Pattern Detection**, Identifies common security anti-patterns such as SQL injection, XSS, command injection, and insecure deserialization

## Quick Start

```bash
# Scan the current directory (all checks)
python3 scripts/security_scan.py .

# Scan dependencies only
python3 scripts/security_scan.py --mode deps .

# Detect secret leaks only
python3 scripts/security_scan.py --mode secrets /path/to/project

# Detect OWASP security patterns only
python3 scripts/security_scan.py --mode owasp .

# Output report in JSON format
python3 scripts/security_scan.py --format json --output report.json .

# Only show findings at high severity and above
python3 scripts/security_scan.py --severity high .
```

## Scan Module Details

### 1. Dependency Vulnerability Scanning (deps)

Automatically detects the project type and invokes the appropriate tool:

| Project Type | Detection File | Tool Used |
|---|---|---|
| Node.js | `package.json` + `package-lock.json` | `npm audit` |
| Python | `requirements.txt` / `pyproject.toml` / `Pipfile` | `pip-audit` |

If the corresponding audit tool is not installed, a helpful message is displayed instead of an error.

### 2. Secret Leak Detection (secrets)

Detection is performed in two ways:

**Regex Matching**: Covers common secret formats

The rest: https://github.com/zebbern/claude-code-guide/blob/HEAD/skills/code-vuln-audit/SKILL.md