source-code-scanning

Name: source-code-scanning
Author: transilienceai

88installs74forks

How to install source-code-scanning?

transilienceai/communitytools/source-code-scanning

$npx -y skills add transilienceai/communitytools --skill source-code-scanning

Installs into the current project.

Summary

Security-focused source code review and SAST. Scans for vulnerabilities (OWASP Top 10, CWE Top 25), CVEs in third-party dependencies/packages, hardcoded secrets, malicious code, and insecure patterns. Use when given source code, a repo path, or asked to "audit", "scan", "review"

Files · 1

View on GitHub

SKILL.md

1	# Source Code Security Review
2
3	## Quick Start
4
5	1. Identify - languages, frameworks, package managers present
6	2. Automated SAST - run tools appropriate to the stack
7	3. Dependency CVEs - scan lockfiles/manifests for known CVEs
8	4. Secrets scan - detect hardcoded credentials/tokens
9	5. Manual review - trace high-risk sinks (exec, eval, query, deserialize)
10	6. Malicious code - check for backdoors, obfuscation, suspicious network calls
11	7. Report - findings with CWE/CVE refs, severity, PoC, remediation
12
13	## Workflow
14
15	### Phase 1: Enumerate
16	```
17	- Languages: ls */.{py,js,ts,java,go,rb,php,cs,rs}
18	- Packages: find package.json, requirements.txt, go.mod, pom.xml, Gemfile, composer.json, Cargo.toml
19	- Entry points: main(), index., app., server.*
20	- Config files: .env, config., settings., .yaml, *.toml
21	```
22
23	### Phase 2: Automated SAST
24	See [sast-tools.md](reference/sast-tools.md) for commands per language.
25
26	Key tools:
27	- Multi-language: Semgrep (`semgrep --config=auto .`)
28	- Python: Bandit (`bandit -r . -f json`)
29	- JavaScript/TS: ESLint security plugin, njsscan
30	- Java: SpotBugs + FindSecBugs
31	- Go: gosec (`gosec ./...`)
32	- PHP: PHPCS Security Audit
33	- Ruby: Brakeman (`brakeman -o report.json`)
34	- All: CodeQL (via `gh codeql`)
35
36	### Phase 3: Dependency CVE Scan
37	See [dependency-cve-scanning.md](reference/dependency-cve-scanning.md) for commands.
38
39	\| Ecosystem \| Command \|
40	\|---\|---\|
41	\| npm/yarn \| `npm audit --json` / `yarn audit` \|
42	\| Python \| `pip-audit -r requirements.txt` \|
43	\| Java \| `dependency-check --scan .` \|
44	\| Go \| `govulncheck ./...` \|
45	\| Ruby \| `bundle audit` \|
46	\| Generic \| `trivy fs .` / `grype dir:.` \|
47
48	### Phase 4: Secrets Detection
49	See [secrets-detection.md](reference/secrets-detection.md).
50	```bash
51	trufflehog filesystem . --json
52	gitleaks detect --source . -v
53	```
54
55	### Phase 5: Manual Review
56	Focus on high-risk sinks — see [manual-review.md](reference/manual-review.md):
57	- Injection sinks: `exec`, `eval`, `query`, `system`, `popen`
58	- Deserialization: `pickle.loads`, `ObjectInputStream`, `unserialize`
59	- Crypto: hardcoded keys, weak algorithms (MD5, SHA1, DES, ECB)
60	- Auth: JWT validation, session management, RBAC enforcement
61	- File ops: path construction with user input
62
63	### Phase 6: Malicious Code
64	See [malicious-code.md](reference/malicious-code.md):
65	- Obfuscated strings (base64, hex, charCode)
66	- Unexpected network calls in library code
67	- Typosquatting indicators
68	- Postinstall/lifecycle script abuse
69	- Hidden backdoors in dependencies
70
71	## Language-Specific Patterns
72	See [language-patterns.md](reference/language-patterns.md) for Python, JS, Java, Go, PHP, Ruby.
73
74	## Severity Mapping
75
76	\| Severity \| CVSS \| Examples \|
77	\|---\|---\|---\|
78	\| Critical \| 9.0+ \| RCE, SQLi with exfil, auth bypass \|
79	\| High \| 7.0-8.9 \| Stored XSS, SSRF, insecure deserialization \|
80	\| Medium \| 4.0-6.9 \| Reflected XSS, info disclosure, IDOR \|
81	\| Low \| 0.1-3.9 \| Missing headers, verbose errors \|
82
83	## Output Format
84
85	```
86	findings/
87	<severity>-<vuln-type>-<location>.md # One file per finding
88	evidence/
89	<tool>-output.json # Raw tool output
90	summary-report.md # Executive summary
91	```
92
93	Each finding: CWE/CVE ID \| File:Line \| Severity \| PoC \| Remediation
94
95	## Mobile App Analysis (APK/IPA)
96
97	When given a mobile app binary:
98	1. Extract: `unzip app.apk -d extracted/` (APKs are ZIP archives)
99	2. Identify framework: React Native (`assets/index.android.bundle`), Flutter (`libflutter.so`), Xamarin, or native
100	3. React Native: JS bundle is plaintext — search for secrets, API keys, config objects, hardcoded tokens
101	4. Encoded secrets: Search for base64 prefixes of known flag/secret formats (e.g., `RkxBR` = base64 of `FLAG`). Config objects often store secrets as base64 in `debug`, `secret`, `apiKey` fields
102	5. Native: Use `jadx` for Java/Kotlin decompilation, check `AndroidManifest.xml`, `strings.xml`, `BuildConfig`
103	6. Shared libs: Check `.so` files with `strings` for hardcoded credentials
104
105	## Critical Rules
106	- Never execute untrusted code during review
107	- Treat all findings as potential until verified
108	- Always cross-reference CVEs against actual version in use
109	- Report supply chain issues separately (they affect all users)

People who liked this also viewed

6 picks

Type

source-code-scanning

88installs74forks

View on GitHub

How to install source-code-scanning?

transilienceai/communitytools/source-code-scanning

$npx -y skills add transilienceai/communitytools --skill source-code-scanning

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Source Code Security Review
2
3	## Quick Start
4
5	1. Identify - languages, frameworks, package managers present
6	2. Automated SAST - run tools appropriate to the stack
7	3. Dependency CVEs - scan lockfiles/manifests for known CVEs
8	4. Secrets scan - detect hardcoded credentials/tokens
9	5. Manual review - trace high-risk sinks (exec, eval, query, deserialize)
10	6. Malicious code - check for backdoors, obfuscation, suspicious network calls
11	7. Report - findings with CWE/CVE refs, severity, PoC, remediation
12
13	## Workflow
14
15	### Phase 1: Enumerate
16	```
17	- Languages: ls */.{py,js,ts,java,go,rb,php,cs,rs}
18	- Packages: find package.json, requirements.txt, go.mod, pom.xml, Gemfile, composer.json, Cargo.toml
19	- Entry points: main(), index., app., server.*
20	- Config files: .env, config., settings., .yaml, *.toml
21	```
22
23	### Phase 2: Automated SAST
24	See [sast-tools.md](reference/sast-tools.md) for commands per language.
25
26	Key tools:
27	- Multi-language: Semgrep (`semgrep --config=auto .`)
28	- Python: Bandit (`bandit -r . -f json`)
29	- JavaScript/TS: ESLint security plugin, njsscan
30	- Java: SpotBugs + FindSecBugs
31	- Go: gosec (`gosec ./...`)
32	- PHP: PHPCS Security Audit
33	- Ruby: Brakeman (`brakeman -o report.json`)
34	- All: CodeQL (via `gh codeql`)
35
36	### Phase 3: Dependency CVE Scan
37	See [dependency-cve-scanning.md](reference/dependency-cve-scanning.md) for commands.
38
39	\| Ecosystem \| Command \|
40	\|---\|---\|
41	\| npm/yarn \| `npm audit --json` / `yarn audit` \|
42	\| Python \| `pip-audit -r requirements.txt` \|
43	\| Java \| `dependency-check --scan .` \|
44	\| Go \| `govulncheck ./...` \|
45	\| Ruby \| `bundle audit` \|
46	\| Generic \| `trivy fs .` / `grype dir:.` \|
47
48	### Phase 4: Secrets Detection
49	See [secrets-detection.md](reference/secrets-detection.md).
50	```bash
51	trufflehog filesystem . --json
52	gitleaks detect --source . -v
53	```
54
55	### Phase 5: Manual Review
56	Focus on high-risk sinks — see [manual-review.md](reference/manual-review.md):
57	- Injection sinks: `exec`, `eval`, `query`, `system`, `popen`
58	- Deserialization: `pickle.loads`, `ObjectInputStream`, `unserialize`
59	- Crypto: hardcoded keys, weak algorithms (MD5, SHA1, DES, ECB)
60	- Auth: JWT validation, session management, RBAC enforcement
61	- File ops: path construction with user input
62
63	### Phase 6: Malicious Code
64	See [malicious-code.md](reference/malicious-code.md):
65	- Obfuscated strings (base64, hex, charCode)
66	- Unexpected network calls in library code
67	- Typosquatting indicators
68	- Postinstall/lifecycle script abuse
69	- Hidden backdoors in dependencies
70
71	## Language-Specific Patterns
72	See [language-patterns.md](reference/language-patterns.md) for Python, JS, Java, Go, PHP, Ruby.
73
74	## Severity Mapping
75
76	\| Severity \| CVSS \| Examples \|
77	\|---\|---\|---\|
78	\| Critical \| 9.0+ \| RCE, SQLi with exfil, auth bypass \|
79	\| High \| 7.0-8.9 \| Stored XSS, SSRF, insecure deserialization \|
80	\| Medium \| 4.0-6.9 \| Reflected XSS, info disclosure, IDOR \|
81	\| Low \| 0.1-3.9 \| Missing headers, verbose errors \|
82
83	## Output Format
84
85	```
86	findings/
87	<severity>-<vuln-type>-<location>.md # One file per finding
88	evidence/
89	<tool>-output.json # Raw tool output
90	summary-report.md # Executive summary
91	```
92
93	Each finding: CWE/CVE ID \| File:Line \| Severity \| PoC \| Remediation
94
95	## Mobile App Analysis (APK/IPA)
96
97	When given a mobile app binary:
98	1. Extract: `unzip app.apk -d extracted/` (APKs are ZIP archives)
99	2. Identify framework: React Native (`assets/index.android.bundle`), Flutter (`libflutter.so`), Xamarin, or native
100	3. React Native: JS bundle is plaintext — search for secrets, API keys, config objects, hardcoded tokens
101	4. Encoded secrets: Search for base64 prefixes of known flag/secret formats (e.g., `RkxBR` = base64 of `FLAG`). Config objects often store secrets as base64 in `debug`, `secret`, `apiKey` fields
102	5. Native: Use `jadx` for Java/Kotlin decompilation, check `AndroidManifest.xml`, `strings.xml`, `BuildConfig`
103	6. Shared libs: Check `.so` files with `strings` for hardcoded credentials
104
105	## Critical Rules
106	- Never execute untrusted code during review
107	- Treat all findings as potential until verified
108	- Always cross-reference CVEs against actual version in use
109	- Report supply chain issues separately (they affect all users)

People who liked this also viewed

6 picks

Type