security-scan

Name: security-scan
Author: jmstar85

151stars12forks

How to install security-scan?

jmstar85/oh-my-githubcopilot/security-scan

$npx -y skills add jmstar85/oh-my-githubcopilot --skill security-scan

Installs into the current project.

Summary

Rapid security scanning workflow for code changes. Activates a focused security sweep. Activate when: security scan, scan for vulnerabilities, check for secrets, security check, run security audit, check deps.

Files · 1

View on GitHub

SKILL.md

1	# Security Scan
2
3	Rapid security sweep for code changes. Faster than a full `/review` — focused on security only.
4
5	## When to Use
6	- Before committing code that touches auth, user input, data storage, or external APIs
7	- After adding new dependencies
8	- Quick pre-PR security gate
9
10	## Scan Protocol
11
12	### Step 1: Determine Scope
13	```bash
14	# Default: scan recent changes
15	git diff --name-only HEAD~1
16
17	# Or use provided path
18	```
19
20	### Step 2: Secrets Scan
21	```bash
22	# Scan for common secret patterns
23	grep -rn --include="*.{ts,js,py,go,rs,java,cs,yaml,json,env,sh,toml}" \
24	-e "sk-[A-Za-z0-9]\{32,\}" \
25	-e "ghp_[A-Za-z0-9]\{36\}" \
26	-e "AKIA[0-9A-Z]\{16\}" \
27	-e "api.key\s=\s['\"][^'\"]\{8,\}" \
28	-e "password\s=\s['\"][^'\"]\{4,\}" \
29	-e "secret\s=\s['\"][^'\"]\{8,\}" \
30	.
31
32	# Check .env is in .gitignore
33	cat .gitignore \| grep -E "\.env$\|\.env\."
34	```
35
36	CRITICAL: Any match in committed code = immediate blocker.
37
38	### Step 3: Dependency Audit
39	Run language-appropriate audit:
40	```bash
41	# Node.js
42	npm audit --audit-level=high
43
44	# Python
45	pip-audit # or: safety check
46
47	# Rust
48	cargo audit
49
50	# Go
51	govulncheck ./...
52
53	# Java/Maven
54	mvn dependency-check:check
55	```
56
57	Report: Count of critical/high severity CVEs and their package names.
58
59	### Step 4: Input Validation Spot-Check
60	For changed files that handle user input (API endpoints, form handlers, CLI args):
61	- Is input validated/sanitized before use?
62	- Are SQL queries parameterized (no string concatenation)?
63	- Is HTML output escaped before rendering?
64	- Are file paths sanitized (no `../` traversal)?
65
66	### Step 5: Auth/Authz Quick Check
67	For changed files touching auth:
68	- Is authentication checked BEFORE authorization?
69	- Are authorization checks on EVERY relevant endpoint?
70	- Are JWT tokens validated (algorithm + signature + expiry)?
71	- Are session cookies `HttpOnly; Secure; SameSite=Strict`?
72
73	---
74
75	## Output Format
76
77	```
78	## Security Scan Report
79
80	Scope: [files scanned]
81	Date: [timestamp]
82
83	### Secrets
84	- [ ] No hardcoded secrets found
85	- ⚠ Found: [file:line — description]
86
87	### Dependencies
88	- Critical CVEs: X
89	- High CVEs: Y
90	- Packages: [list if any]
91
92	### Input Validation
93	- [ ] User inputs sanitized in changed files
94	- ⚠ Risk: [file:line — description]
95
96	### Auth
97	- [ ] Auth/authz checks present on relevant routes
98	- ⚠ Risk: [file:line — description]
99
100	### Verdict
101	CLEAN / NEEDS ATTENTION / BLOCKER
102
103	### Next Steps
104	- [Action items with file:line references]
105	```
106
107	## Severity Quick Reference
108
109	\| Finding \| Severity \| Action \|
110	\|---------\|----------\|--------\|
111	\| Hardcoded secret in committed file \| CRITICAL \| Rotate key + remove from history \|
112	\| Critical CVE in direct dependency \| HIGH \| Update package immediately \|
113	\| SQL injection risk \| CRITICAL \| Parameterize query before PR \|
114	\| Missing auth check on endpoint \| HIGH \| Add before PR \|
115	\| High CVE in transitive dependency \| MEDIUM \| Track in backlog \|
116	\| HTTP instead of HTTPS \| MEDIUM \| Enforce HTTPS redirect \|
117
118	## See Also
119
120	- `@security-reviewer` — comprehensive OWASP Top 10 security review
121	- `/review` — full code review including security
122	- `/coding-standards` — baseline code quality rules

People who liked this also viewed

6 picks

Type

security-scan

151stars12forks

View on GitHub

How to install security-scan?

jmstar85/oh-my-githubcopilot/security-scan

$npx -y skills add jmstar85/oh-my-githubcopilot --skill security-scan

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Security Scan
2
3	Rapid security sweep for code changes. Faster than a full `/review` — focused on security only.
4
5	## When to Use
6	- Before committing code that touches auth, user input, data storage, or external APIs
7	- After adding new dependencies
8	- Quick pre-PR security gate
9
10	## Scan Protocol
11
12	### Step 1: Determine Scope
13	```bash
14	# Default: scan recent changes
15	git diff --name-only HEAD~1
16
17	# Or use provided path
18	```
19
20	### Step 2: Secrets Scan
21	```bash
22	# Scan for common secret patterns
23	grep -rn --include="*.{ts,js,py,go,rs,java,cs,yaml,json,env,sh,toml}" \
24	-e "sk-[A-Za-z0-9]\{32,\}" \
25	-e "ghp_[A-Za-z0-9]\{36\}" \
26	-e "AKIA[0-9A-Z]\{16\}" \
27	-e "api.key\s=\s['\"][^'\"]\{8,\}" \
28	-e "password\s=\s['\"][^'\"]\{4,\}" \
29	-e "secret\s=\s['\"][^'\"]\{8,\}" \
30	.
31
32	# Check .env is in .gitignore
33	cat .gitignore \| grep -E "\.env$\|\.env\."
34	```
35
36	CRITICAL: Any match in committed code = immediate blocker.
37
38	### Step 3: Dependency Audit
39	Run language-appropriate audit:
40	```bash
41	# Node.js
42	npm audit --audit-level=high
43
44	# Python
45	pip-audit # or: safety check
46
47	# Rust
48	cargo audit
49
50	# Go
51	govulncheck ./...
52
53	# Java/Maven
54	mvn dependency-check:check
55	```
56
57	Report: Count of critical/high severity CVEs and their package names.
58
59	### Step 4: Input Validation Spot-Check
60	For changed files that handle user input (API endpoints, form handlers, CLI args):
61	- Is input validated/sanitized before use?
62	- Are SQL queries parameterized (no string concatenation)?
63	- Is HTML output escaped before rendering?
64	- Are file paths sanitized (no `../` traversal)?
65
66	### Step 5: Auth/Authz Quick Check
67	For changed files touching auth:
68	- Is authentication checked BEFORE authorization?
69	- Are authorization checks on EVERY relevant endpoint?
70	- Are JWT tokens validated (algorithm + signature + expiry)?
71	- Are session cookies `HttpOnly; Secure; SameSite=Strict`?
72
73	---
74
75	## Output Format
76
77	```
78	## Security Scan Report
79
80	Scope: [files scanned]
81	Date: [timestamp]
82
83	### Secrets
84	- [ ] No hardcoded secrets found
85	- ⚠ Found: [file:line — description]
86
87	### Dependencies
88	- Critical CVEs: X
89	- High CVEs: Y
90	- Packages: [list if any]
91
92	### Input Validation
93	- [ ] User inputs sanitized in changed files
94	- ⚠ Risk: [file:line — description]
95
96	### Auth
97	- [ ] Auth/authz checks present on relevant routes
98	- ⚠ Risk: [file:line — description]
99
100	### Verdict
101	CLEAN / NEEDS ATTENTION / BLOCKER
102
103	### Next Steps
104	- [Action items with file:line references]
105	```
106
107	## Severity Quick Reference
108
109	\| Finding \| Severity \| Action \|
110	\|---------\|----------\|--------\|
111	\| Hardcoded secret in committed file \| CRITICAL \| Rotate key + remove from history \|
112	\| Critical CVE in direct dependency \| HIGH \| Update package immediately \|
113	\| SQL injection risk \| CRITICAL \| Parameterize query before PR \|
114	\| Missing auth check on endpoint \| HIGH \| Add before PR \|
115	\| High CVE in transitive dependency \| MEDIUM \| Track in backlog \|
116	\| HTTP instead of HTTPS \| MEDIUM \| Enforce HTTPS redirect \|
117
118	## See Also
119
120	- `@security-reviewer` — comprehensive OWASP Top 10 security review
121	- `/review` — full code review including security
122	- `/coding-standards` — baseline code quality rules

People who liked this also viewed

6 picks

Type