Menu

Not in the top 1,000 by GitHub stars

Ray0907/security-scan

Security scanning skill for AI coding agents. CVE vulnerability detection, OWASP Top 10 code analysis, and dependency audits. Follows agentskills.io specification.

Claude CodeSecurityEngineering

History

Review weekly changes to SKILL.md before updating. Dates mark the weeks in which we observed each version; checks apply to the recorded commits.

View weekly changes

SKILL.md

Week of Nov 2, 2026 · +0 / −0 lines

Before Network or broad shell → After Network or broad shell

1ad9f43a41b2 → 1ad9f43a41b2

Compare on GitHub

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → 1ad9f43a41b2

No earlier version was observed for comparison.

Compare on GitHub

View on GitHubAdd to my skills

Verified commit 1ad9f43a41b22a76a3ed26ab139a6bf5bd852769

git clone --filter=blob:none --no-checkout https://github.com/Ray0907/security-scan.git .hotskills/ray0907-security-scan && git -C .hotskills/ray0907-security-scan checkout --detach 1ad9f43a41b22a76a3ed26ab139a6bf5bd852769 # Copy each selected skill directory from .hotskills/ray0907-security-scan into .claude/skills/<skill-name>/
20GitHub stars
0stars in 7 days
1skill in this repository
5commits in 30 days

Heat

1.4
  • Star growth, last 7 daysNot available
  • Star growth, last 24 hoursNot available
  • Rank movement, last 7 daysNot available
  • Commits, last 30 daysNot available
  • Accounts asking about it through MCP, last 7 daysNot available
  • Hot votes this weekNot available

Heat never changes the order by stars, and sponsorship never touches it. How heat works

Stars over time

Oct 25, 2026Oct 25, 202620

30-day change not yet available: not enough history.

Individual skills in this repository

How it works

security-scan

When your agent uses it

Use when a user asks to scan a repository for dependency vulnerabilities, license compliance, insecure code patterns, CVEs, or OWASP Top 10 risks.

What it loads into context

Frontmatter

62 tokens

Always available to the agent

SKILL.md

1,481 tokens

When the skill is activated

Reference documents

19,099 tokens

Loaded on request

Token counts are estimates. Scripts run separately; they are not counted as reference context.

The playbook

  1. Boundaries
  2. Guidance vs Full Scan
  3. Interpret the Request
  4. Workflow
  5. Completion Gate
  6. Anti-Patterns

Scripts executed separately

  • scripts/check_runtime.py
  • scripts/normalize_findings.py
  • scripts/redaction.py
  • scripts/run_plan.py
  • scripts/scan_plan.py
  • scripts/validate_report.py
  • scripts/verdict_rules.py
  • tests/test_check_runtime.py
  • tests/test_normalize_findings.py
  • tests/test_run_plan.py
  • tests/test_scan_plan.py
  • tests/test_validate_report.py

Files

  • .claude-plugin/plugin.jsonasset418 bytes
  • .github/dependabot.ymlasset114 bytes
  • .github/workflows/validate.ymlasset1,364 bytes
  • .gitignoreasset30 bytes
  • .markdownlint.jsonasset20 bytes
  • CHANGELOG.mddoc5,930 bytes
  • LICENSEasset1,065 bytes
  • README.mddoc10,729 bytes
  • SECURITY.mddoc1,112 bytes
  • SKILL.mdcore6,617 bytes
  • SKILL.mdcore6,617 bytes
  • SKILL.mdcore6,617 bytes
  • SKILL.mdcore6,617 bytes
  • SKILL.mdcore6,617 bytes
  • docs/constitution.mddoc2,349 bytes
  • docs/req-001-verdict-injection/issues/sarif-rejected-gate.mddoc2,004 bytes
  • docs/req-001-verdict-injection/issues/skill-untrusted-content.mddoc3,116 bytes
  • docs/req-001-verdict-injection/issues/validator-rejected-trace.mddoc3,579 bytes
  • docs/req-001-verdict-injection/queue.mddoc134 bytes
  • docs/req-001-verdict-injection/requirements.mddoc3,120 bytes
  • docs/superpowers/plans/2026-08-30-planner-correctness.mddoc7,559 bytes
  • docs/superpowers/plans/2026-09-24-report-correctness.mddoc4,799 bytes
  • docs/superpowers/specs/2026-08-30-planner-correctness-design.mddoc4,288 bytes
  • references/OWASP.mddoc4,078 bytes
  • references/REPORTING.mddoc10,411 bytes
  • references/SCANNERS.mddoc12,992 bytes
  • schema/run.schema.jsonasset3,619 bytes
  • schema/scan-plan.schema.jsonasset2,500 bytes
  • schema/security-findings.schema.jsonasset12,006 bytes
  • scripts/check_runtime.pyruns14,730 bytes
  • scripts/normalize_findings.pyruns38,976 bytes
  • scripts/redaction.pyruns1,414 bytes
  • scripts/run_plan.pyruns11,143 bytes
  • scripts/scan_plan.pyruns24,890 bytes
  • scripts/validate_report.pyruns3,633 bytes
  • scripts/verdict_rules.pyruns1,317 bytes
  • tests/fixtures/README.mddoc1,811 bytes
  • tests/fixtures/bun/clean.jsonasset3 bytes
  • tests/fixtures/bun/findings.jsonasset410 bytes
  • tests/fixtures/bundler-audit/clean.jsonasset73 bytes
  • tests/fixtures/bundler-audit/findings.jsonasset3,087 bytes
  • tests/fixtures/cargo-audit/clean.jsonasset373 bytes
  • tests/fixtures/cargo-audit/findings.jsonasset5,657 bytes
  • tests/fixtures/composer/clean.jsonasset64 bytes
  • tests/fixtures/composer/findings.jsonasset1,191 bytes
  • tests/fixtures/gitleaks/clean.jsonasset3 bytes
  • tests/fixtures/gitleaks/findings.jsonasset1,121 bytes
  • tests/fixtures/govulncheck/clean.ndjsonasset1,674 bytes
  • tests/fixtures/govulncheck/findings.ndjsonasset4,663 bytes
  • tests/fixtures/npm/clean.jsonasset358 bytes
  • tests/fixtures/npm/findings.jsonasset1,747 bytes
  • tests/fixtures/osv-scanner-license/Cargo.lockasset613 bytes
  • tests/fixtures/osv-scanner-license/node.jsonasset567 bytes
  • tests/fixtures/osv-scanner-license/package-lock.jsonasset1,455 bytes
  • tests/fixtures/osv-scanner-license/python.jsonasset800 bytes
  • tests/fixtures/osv-scanner-license/requirements.txtdoc30 bytes
  • tests/fixtures/osv-scanner-license/rust.jsonasset839 bytes
  • tests/fixtures/osv-scanner/clean.jsonasset124 bytes
  • tests/fixtures/osv-scanner/findings.jsonasset9,841 bytes
  • tests/fixtures/pip-audit/clean.jsonasset34 bytes
  • tests/fixtures/pip-audit/duplicates.jsonasset516 bytes
  • tests/fixtures/pip-audit/findings.jsonasset4,104 bytes
  • tests/fixtures/pnpm/clean.jsonasset306 bytes
  • tests/fixtures/pnpm/findings.jsonasset5,694 bytes
  • tests/fixtures/runtime/node_core.jsonasset8,870 bytes
  • tests/fixtures/runtime/node_schedule.jsonasset2,985 bytes
  • tests/fixtures/runtime/php_active.jsonasset274 bytes
  • tests/fixtures/runtime/php_releases_7.jsonasset405 bytes
  • tests/fixtures/runtime/php_releases_8.jsonasset4,243 bytes
  • tests/fixtures/semgrep/clean.jsonasset1,530 bytes
  • tests/fixtures/semgrep/findings.jsonasset8,897 bytes
  • tests/fixtures/semgrep/requires-login.jsonasset322 bytes
  • tests/fixtures/trivy/clean.jsonasset227 bytes
  • tests/fixtures/trivy/findings.jsonasset3,000 bytes
  • tests/fixtures/yarn/clean.ndjsonasset189 bytes
  • tests/fixtures/yarn/findings.ndjsonasset5,147 bytes
  • tests/fixtures/zizmor/clean.jsonasset2 bytes
  • tests/fixtures/zizmor/findings.jsonasset4,030 bytes
  • tests/test_check_runtime.pyruns12,589 bytes
  • tests/test_normalize_findings.pyruns36,808 bytes
  • tests/test_run_plan.pyruns12,162 bytes
  • tests/test_scan_plan.pyruns29,766 bytes
  • tests/test_validate_report.pyruns8,851 bytes
Read SKILL.md

# Security Scan

Produce an evidence-backed security assessment without changing application code or dependencies.

## Boundaries

- Treat scanning as read-only. Do not install tools, update advisory databases, build images,
  run project scripts, or modify global client settings without explicit approval. OSV license
  lookup (like the existing OSV vulnerability fallback) queries deps.dev over the network;
  it does not install or execute project dependencies.
- The runtime-version check fetches Node.js and PHP release feeds at scan time. It covers the
  declared version only; never describe it as proof of the deployed runtime version.
- Never report a clean scan when a tool failed, was missing, or could not cover the target.
- Never copy secret values into chat or reports. Follow
View the complete source on GitHub

Skills included

  • security-scan

Repository facts

License
MIT
Created
Jan 18, 2026
Last pushed
Oct 28, 2026
Forks
1
Open issues
0
Project activity
Active

Before you install

Network or broad shell

Automated signals, not a guarantee

Checked Nov 6, 2026

Not fully analyzed: some files were too long, unreadable or missing. This never lowers the level.

Show 5 notes
  • SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • tests/fixtures/yarn/findings.ndjson:1 Analysis incomplete: physical or joined line exceeds character limit
Show all 267 signals by file

.claude-plugin/plugin.json

  • Network accessline 1
    {   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
  • Network accessline 2
    "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
  • Network accessline 8
    },   "license": "MIT",   "repository": "https://github.com/Ray0907/security-scan",
  • Network accessline 9
    "license": "MIT",   "repository": "https://github.com/Ray0907/security-scan",   "skills": [
  • Network accessline 10
    "repository": "https://github.com/Ray0907/security-scan",

CHANGELOG.md

  • Network accessline 5
    The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
  • Network accessline 6
    uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
  • Network accessline 123
    [Unreleased]: https://github.com/Ray0907/security-scan/compare/v1.7.0...HEAD
  • Network accessline 124
    [1.7.0]: https://github.com/Ray0907/security-scan/compare/v1.6.0...v1.7.0
  • Network accessline 125
    [1.6.0]: https://github.com/Ray0907/security-scan/compare/v1.5.0...v1.6.0
  • Network accessline 126
    [1.5.0]: https://github.com/Ray0907/security-scan/compare/v1.4.0...v1.5.0
  • Network accessline 127
    [1.4.0]: https://github.com/Ray0907/security-scan/compare/v1.3.1...v1.4.0
  • Network accessline 128
    [1.3.1]: https://github.com/Ray0907/security-scan/compare/v1.3.0...v1.3.1
  • Network accessline 129
    [1.3.0]: https://github.com/Ray0907/security-scan/compare/v1.2.0...v1.3.0
  • Network accessline 130
    [1.2.0]: https://github.com/Ray0907/security-scan/compare/v1.1.0...v1.2.0
  • Network accessline 131
    [1.1.0]: https://github.com/Ray0907/security-scan/compare/v1.0.0...v1.1.0
  • Network accessline 132
    [1.0.0]: https://github.com/Ray0907/security-scan/releases/tag/v1.0.0

README.md

  • Network accessline 3
    [![Agent Skills compatible](https://img.shields.io/badge/Agent%20Skills-compatible-blue)](https://agentskills.io)
  • Network accessline 4
    [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
  • Network accessline 5
    [![Release](https://img.shields.io/github/v/release/Ray0907/security-scan)](https://github.com/Ray0907/security-scan/releases)
  • Network accessline 6
    [![Validate](https://github.com/Ray0907/security-scan/actions/workflows/validate.yml/badge.svg)](https://github.com/Ray0907/security-scan/actions/workflows/validate.yml)
  • Network accessline 8
    An [Agent Skills](https://agentskills.io/specification) security workflow for AI coding agents.
  • Network accessline 18
    findings. - Use Cloudflare's complementary   [security-audit-skill](https://github.com/cloudflare/security-audit-skill) for a logic-level
  • Network accessline 19
    - Use Cloudflare's complementary   [security-audit-skill](https://github.com/cloudflare/security-audit-skill) for a logic-level   source audit.
  • Network accessline 20
    [security-audit-skill](https://github.com/cloudflare/security-audit-skill) for a logic-level
  • Network accessline 32
    With the [Skills CLI](https://skills.sh), which installs into any supported coding agent:
  • Network accessline 43
    git clone https://github.com/Ray0907/security-scan.git ~/.claude/skills/security-scan
  • Network accessline 169
    "owasp_2025": ["A03"],   "package": "minimist",   "references": ["https://github.com/advisories/GHSA-xvch-5gv4-984h"],
  • Network accessline 170
    "package": "minimist",   "references": ["https://github.com/advisories/GHSA-xvch-5gv4-984h"],   "rule_id": null,
  • Network accessline 171
    "references": ["https://github.com/advisories/GHSA-xvch-5gv4-984h"],

SECURITY.md

  • Network accessline 9
    Use GitHub's private vulnerability reporting through this repository's [Security Advisories](https://github.com/Ray0907/security-scan/security/advisories/new). Do not open
  • Network accessline 10
    [Security Advisories](https://github.com/Ray0907/security-scan/security/advisories/new). Do not open

references/OWASP.md

  • Network accessline 3
    Use this reference when normalizing scanner output or reporting OWASP coverage. The authoritative source is the [OWASP Top 10:2025](https://owasp.org/Top10/).
  • Network accessline 4
    source is the [OWASP Top 10:2025](https://owasp.org/Top10/).

references/SCANNERS.md

  • Network accessline 217
    Composer, Bun, and the relevant Node package manager are expected to come from the project toolchain. Choose one supported Zizmor installation method; do not install it three times. Avoid remote-script pipelines such as `curl ... | sh`.
  • Dangerous shell operationline 219
    Avoid remote-script pipelines such as `curl ... | sh`.
  • Network accessline 219
    Avoid remote-script pipelines such as `curl ... | sh`.
  • Network accessline 223
    Use the [NVD CVE API](https://nvd.nist.gov/developers/vulnerabilities) only for verified CVE IDs. The `cveId` parameter is deprecated; use comma-separated `cveIds`, at most 100 per request. Without an API key, limit requests to 5 per rollin
  • Network accessline 227
    Use `curl --fail --show-error --silent`, validate the JSON response, cache results for the scan, and

schema/run.schema.json

  • Network accessline 175
    "records"   ],   "$schema": "https://json-schema.org/draft/2020-12/schema",
  • Network accessline 176
    ],   "$schema": "https://json-schema.org/draft/2020-12/schema",   "$id": "https://raw.githubusercontent.com/Ray0907/security-scan/main/schema/run.schema.json"
  • Network accessline 177
    "$schema": "https://json-schema.org/draft/2020-12/schema",
  • Network accessline 178
    "$id": "https://raw.githubusercontent.com/Ray0907/security-scan/main/schema/run.schema.json"

schema/scan-plan.schema.json

  • Network accessline 115
    "projects"   ],   "$schema": "https://json-schema.org/draft/2020-12/schema",
  • Network accessline 116
    ],   "$schema": "https://json-schema.org/draft/2020-12/schema",   "$id": "https://raw.githubusercontent.com/Ray0907/security-scan/main/schema/scan-plan.schema.json"
  • Network accessline 117
    "$schema": "https://json-schema.org/draft/2020-12/schema",
  • Network accessline 118
    "$id": "https://raw.githubusercontent.com/Ray0907/security-scan/main/schema/scan-plan.schema.json"

schema/security-findings.schema.json

  • Network accessline 546
    "verdicts_unmatched"   ],   "$schema": "https://json-schema.org/draft/2020-12/schema",
  • Network accessline 547
    ],   "$schema": "https://json-schema.org/draft/2020-12/schema",   "$id": "https://raw.githubusercontent.com/Ray0907/security-scan/main/schema/security-findings.schema.json"
  • Network accessline 548
    "$schema": "https://json-schema.org/draft/2020-12/schema",
  • Network accessline 549
    "$id": "https://raw.githubusercontent.com/Ray0907/security-scan/main/schema/security-findings.schema.json"

scripts/check_runtime.py

  • Executable scriptline 1
    #!/usr/bin/env python3
  • Network accessline 19
    MAX_FEED_BYTES = 20_000_000 COVERAGE = "declared-version-only" URL_NODE_CORE = "https://raw.githubusercontent.com/nodejs/security-wg/main/vuln/core/index.json"
  • Network accessline 20
    COVERAGE = "declared-version-only" URL_NODE_CORE = "https://raw.githubusercontent.com/nodejs/security-wg/main/vuln/core/index.json" URL_NODE_SCHEDULE = "https://raw.githubusercontent.com/nodejs/Release/main/schedule.json"
  • Network accessline 21
    URL_NODE_CORE = "https://raw.githubusercontent.com/nodejs/security-wg/main/vuln/core/index.json"
  • Network accessline 22
    URL_NODE_SCHEDULE = "https://raw.githubusercontent.com/nodejs/Release/main/schedule.json"
  • Network accessline 23
    URL_PHP_ACTIVE = "https://www.php.net/releases/active.php"
  • Network accessline 24
    URL_PHP_RELEASES = "https://www.php.net/releases/index.php?json&version={major}&max=1000"
  • Network accessline 199
    body, url_record = path_feed.read_bytes(), path_feed.as_uri() 			else: 				request = urllib.request.Request(
  • Network accessline 200
    else: 				request = urllib.request.Request( 					url_feed, headers={"User-Agent": "security-scan-runtime-check"})
  • Network accessline 201
    request = urllib.request.Request(
  • Network accessline 202
    url_feed, headers={"User-Agent": "security-scan-runtime-check"}) 				with urllib.request.urlopen(request, timeout=30) as response: 					body, url_record = response.read(MAX_FEED_BYTES), url_feed
  • Network accessline 203
    with urllib.request.urlopen(request, timeout=30) as response:
  • Network accessline 239
    severity="medium", confidence="high", 		summary=f"Node.js {major} reached end of life on {text_end} and gets no security fixes", 		references=["https://github.com/nodejs/Release/blob/main/schedule.json"])]
  • Network accessline 241
    references=["https://github.com/nodejs/Release/blob/main/schedule.json"])]
  • Network accessline 277
    severity="medium", confidence="high", 			summary=f"PHP {branch} is not in php.net's active list and gets no security fixes", 			references=["https://www.php.net/supported-versions.php"])]
  • Network accessline 278
    summary=f"PHP {branch} is not in php.net's active list and gets no security fixes", 			references=["https://www.php.net/supported-versions.php"])] 	if parsed["class"] != "exact":
  • Network accessline 279
    references=["https://www.php.net/supported-versions.php"])]
  • Network accessline 298
    summary=(f"PHP {parsed['version']} is older than security release {latest}; " 			"php.net publishes no CVE mapping, so this is not CVE-matched"), 		references=[f"https://www.php.net/ChangeLog-{branch.split('.')[0]}.php#{latest}"])]
  • Network accessline 300
    references=[f"https://www.php.net/ChangeLog-{branch.split('.')[0]}.php#{latest}"])]

scripts/normalize_findings.py

  • Executable scriptline 1
    #!/usr/bin/env python3
  • Network accessline 924
    } 		) 	return {"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": runs_sarif}
  • Network accessline 926
    return {"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": runs_sarif}

scripts/redaction.py

  • Executable scriptline 1
    Executable file

scripts/run_plan.py

  • Executable scriptline 1
    #!/usr/bin/env python3

scripts/scan_plan.py

  • Executable scriptline 1
    #!/usr/bin/env python3

scripts/validate_report.py

  • Executable scriptline 1
    #!/usr/bin/env python3

scripts/verdict_rules.py

  • Executable scriptline 1
    Executable file

tests/fixtures/bun/findings.json

  • Network accessline 12
    "severity": "critical",       "title": "Prototype Pollution in minimist",       "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h",
  • Network accessline 13
    "title": "Prototype Pollution in minimist",       "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h",       "vulnerable_versions": ">=1.0.0 <1.2.6"
  • Network accessline 14
    "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h",

tests/fixtures/bundler-audit/findings.json

  • Network accessline 4
    last updated:	2026-09-13 19:01:17 -0400   commit:	f08b5bf5b2778201db0b69f0faa7a407e2476cb8 {"version":"0.9.3","created_at":"2026-09-16 16:45:56 +0800","results":[{"type":"unpatched_gem","gem":{"name":"rack","version":"2.2.3"},"advisory":{"p
  • Network accessline 6
    {"version":"0.9.3","created_at":"2026-09-16 16:45:56 +0800","results":[{"type":"unpatched_gem","gem":{"name":"rack","version":"2.2.3"},"advisory":{"path":"/Users/ray/.local/share/ruby-advisory-db/gems/rack/CVE-2024-26146.yml","id":"CVE-2024

tests/fixtures/cargo-audit/findings.json

  • Network accessline 36
    "cvss": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",           "date": "2020-11-18",           "description": "### Impact\n\nThe affected functions set environment variables without synchronization. On Unix-like operating systems, this c
  • Network accessline 37
    "date": "2020-11-18",           "description": "### Impact\n\nThe affected functions set environment variables without synchronization. On Unix-like operating systems, this can crash in multithreaded programs. Programs may segfault due to d
  • Network accessline 38
    "description": "### Impact\n\nThe affected functions set environment variables without synchronization. On Unix-like operating systems, this can crash in multithreaded programs. Programs may segfault due to dereferencing a dangling pointer
  • Network accessline 49
    "source": null,           "title": "Potential segfault in the time crate",           "url": "https://github.com/time-rs/time/issues/293",
  • Network accessline 50
    "title": "Potential segfault in the time crate",           "url": "https://github.com/time-rs/time/issues/293",           "withdrawn": null
  • Network accessline 51
    "url": "https://github.com/time-rs/time/issues/293",
  • Network accessline 100
    {               "name": "libc",               "source": "registry+https://github.com/rust-lang/crates.io-index",
  • Network accessline 101
    "name": "libc",               "source": "registry+https://github.com/rust-lang/crates.io-index",               "version": "0.2.189"
  • Network accessline 102
    "source": "registry+https://github.com/rust-lang/crates.io-index",
  • Network accessline 105
    {               "name": "winapi",               "source": "registry+https://github.com/rust-lang/crates.io-index",
  • Network accessline 106
    "name": "winapi",               "source": "registry+https://github.com/rust-lang/crates.io-index",               "version": "0.3.9"
  • Network accessline 107
    "source": "registry+https://github.com/rust-lang/crates.io-index",
  • Network accessline 111
    "name": "time",           "replace": null,           "source": "registry+https://github.com/rust-lang/crates.io-index",
  • Network accessline 112
    "replace": null,           "source": "registry+https://github.com/rust-lang/crates.io-index",           "version": "0.1.43"
  • Network accessline 113
    "source": "registry+https://github.com/rust-lang/crates.io-index",

tests/fixtures/composer/findings.json

  • Network accessline 7
    "affectedVersions": ">=8.0.0,<8.0.1|<7.15.2",         "cve": "CVE-2026-69246",         "link": "https://github.com/advisories/GHSA-v5mv-p594-2x33",
  • Network accessline 8
    "cve": "CVE-2026-69246",         "link": "https://github.com/advisories/GHSA-v5mv-p594-2x33",         "packageName": "guzzlehttp/guzzle",
  • Network accessline 9
    "link": "https://github.com/advisories/GHSA-v5mv-p594-2x33",
  • Network accessline 23
    "affectedVersions": ">=8.0.0,<8.0.1|<7.15.2",         "cve": "CVE-2026-69245",         "link": "https://github.com/advisories/GHSA-f7vp-7xgx-4w4r",
  • Network accessline 24
    "cve": "CVE-2026-69245",         "link": "https://github.com/advisories/GHSA-f7vp-7xgx-4w4r",         "packageName": "guzzlehttp/guzzle",
  • Network accessline 25
    "link": "https://github.com/advisories/GHSA-f7vp-7xgx-4w4r",

tests/fixtures/govulncheck/clean.ndjson

  • Network accessline 1
    {"config": {"protocol_version": "v1.0.0", "scanner_name": "govulncheck", "scanner_version": "v1.8.0", "db": "https://vuln.go.dev", "db_last_modified": "2026-09-15T18:39:25Z", "go_version": "go1.26.6", "scan_level": "symbol", "scan_mode": "s
  • Network accessline 3
    {"progress": {"message": "Fetching vulnerabilities from the database..."}} {"progress": {"message": "Checking the code against the vulnerabilities..."}} {"osv": {"schema_version": "1.3.1", "id": "GO-2021-0067", "modified": "2024-05-20T16:03
  • Network accessline 5
    {"osv": {"schema_version": "1.3.1", "id": "GO-2021-0067", "modified": "2024-05-20T16:03:47Z", "published": "2021-04-14T20:04:52Z", "aliases": ["CVE-2021-27919"], "summary": "Panic when opening archives in archive/zip", "details": "Using Rea

tests/fixtures/govulncheck/findings.ndjson

  • Network accessline 4
    "scanner_name": "govulncheck",     "scanner_version": "v1.8.0",     "db": "https://vuln.go.dev",
  • Network accessline 5
    "scanner_version": "v1.8.0",     "db": "https://vuln.go.dev",     "db_last_modified": "2026-09-15T18:39:25Z",
  • Network accessline 6
    "db": "https://vuln.go.dev",
  • Network accessline 58
    {         "type": "REPORT",         "url": "https://go.dev/issue/56152"
  • Network accessline 59
    "type": "REPORT",         "url": "https://go.dev/issue/56152"       },
  • Network accessline 60
    "url": "https://go.dev/issue/56152"
  • Network accessline 62
    {         "type": "FIX",         "url": "https://go.dev/cl/442235"
  • Network accessline 63
    "type": "FIX",         "url": "https://go.dev/cl/442235"       },
  • Network accessline 64
    "url": "https://go.dev/cl/442235"
  • Network accessline 66
    {         "type": "WEB",         "url": "https://groups.google.com/g/golang-announce/c/-hjNw559_tE/m/KlGTfid5CAAJ"
  • Network accessline 67
    "type": "WEB",         "url": "https://groups.google.com/g/golang-announce/c/-hjNw559_tE/m/KlGTfid5CAAJ"       }
  • Network accessline 68
    "url": "https://groups.google.com/g/golang-announce/c/-hjNw559_tE/m/KlGTfid5CAAJ"
  • Network accessline 78
    ],     "database_specific": {       "url": "https://pkg.go.dev/vuln/GO-2022-1059",
  • Network accessline 79
    "database_specific": {       "url": "https://pkg.go.dev/vuln/GO-2022-1059",       "review_status": "REVIEWED"
  • Network accessline 80
    "url": "https://pkg.go.dev/vuln/GO-2022-1059",
  • Network accessline 152
    {         "type": "REPORT",         "url": "https://go.dev/issue/80142"
  • Network accessline 153
    "type": "REPORT",         "url": "https://go.dev/issue/80142"       },
  • Network accessline 154
    "url": "https://go.dev/issue/80142"
  • Network accessline 156
    {         "type": "FIX",         "url": "https://go.dev/cl/794100"
  • Network accessline 157
    "type": "FIX",         "url": "https://go.dev/cl/794100"       }
  • Network accessline 158
    "url": "https://go.dev/cl/794100"
  • Network accessline 165
    ],     "database_specific": {       "url": "https://pkg.go.dev/vuln/GO-2026-5970",
  • Network accessline 166
    "database_specific": {       "url": "https://pkg.go.dev/vuln/GO-2026-5970",       "review_status": "REVIEWED"
  • Network accessline 167
    "url": "https://pkg.go.dev/vuln/GO-2026-5970",

tests/fixtures/npm/findings.json

  • Network accessline 50
    "source": 1106913,           "title": "Command Injection in lodash",           "url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm"
  • Network accessline 51
    "title": "Command Injection in lodash",           "url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm"         },
  • Network accessline 52
    "url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm"
  • Network accessline 67
    "source": 1108258,           "title": "Regular Expression Denial of Service (ReDoS) in lodash",           "url": "https://github.com/advisories/GHSA-29mw-wpgm-hmr9"
  • Network accessline 68
    "title": "Regular Expression Denial of Service (ReDoS) in lodash",           "url": "https://github.com/advisories/GHSA-29mw-wpgm-hmr9"         }
  • Network accessline 69
    "url": "https://github.com/advisories/GHSA-29mw-wpgm-hmr9"

tests/fixtures/osv-scanner-license/Cargo.lock

  • Network accessline 6
    name = "proc-macro2" version = "1.0.107" source = "registry+https://github.com/rust-lang/crates.io-index"
  • Network accessline 7
    version = "1.0.107" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
  • Network accessline 8
    source = "registry+https://github.com/rust-lang/crates.io-index"
  • Network accessline 22
    name = "unicode-ident" version = "1.0.26" source = "registry+https://github.com/rust-lang/crates.io-index"
  • Network accessline 23
    version = "1.0.26" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d245f478577f809a851594d02313b640fb437e0bb33866753cff937863096954"
  • Network accessline 24
    source = "registry+https://github.com/rust-lang/crates.io-index"

tests/fixtures/osv-scanner-license/package-lock.json

  • Network accessline 15
    "node_modules/balanced-match": {       "version": "1.0.2",       "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
  • Network accessline 16
    "version": "1.0.2",       "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",       "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
  • Network accessline 17
    "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
  • Network accessline 21
    "node_modules/glob": {       "version": "7.2.3",       "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
  • Network accessline 22
    "version": "7.2.3",       "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",       "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
  • Network accessline 23
    "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
  • Network accessline 37
    },       "funding": {         "url": "https://github.com/sponsors/isaacs"
  • Network accessline 38
    "funding": {         "url": "https://github.com/sponsors/isaacs"       }
  • Network accessline 39
    "url": "https://github.com/sponsors/isaacs"

tests/fixtures/osv-scanner/findings.json

  • Network accessline 46
    {                   "database_specific": {                     "source": "https://github.com/pypa/advisory-database/blob/main/vulns/idna/PYSEC-2024-60.yaml"
  • Network accessline 47
    "database_specific": {                     "source": "https://github.com/pypa/advisory-database/blob/main/vulns/idna/PYSEC-2024-60.yaml"                   },
  • Network accessline 48
    "source": "https://github.com/pypa/advisory-database/blob/main/vulns/idna/PYSEC-2024-60.yaml"
  • Network accessline 63
    }                       ],                       "repo": "https://github.com/kjd/idna",
  • Network accessline 64
    ],                       "repo": "https://github.com/kjd/idna",                       "type": "GIT"
  • Network accessline 65
    "repo": "https://github.com/kjd/idna",
  • Network accessline 147
    {                   "type": "EVIDENCE",                   "url": "https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb"
  • Network accessline 148
    "type": "EVIDENCE",                   "url": "https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb"                 },
  • Network accessline 149
    "url": "https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb"
  • Network accessline 151
    {                   "type": "FIX",                   "url": "https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb"
  • Network accessline 152
    "type": "FIX",                   "url": "https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb"                 },
  • Network accessline 153
    "url": "https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb"
  • Network accessline 155
    {                   "type": "FIX",                   "url": "https://github.com/kjd/idna/commit/1d365e17e10d72d0b7876316fc7b9ca0eebdd38d"
  • Network accessline 156
    "type": "FIX",                   "url": "https://github.com/kjd/idna/commit/1d365e17e10d72d0b7876316fc7b9ca0eebdd38d"                 },
  • Network accessline 157
    "url": "https://github.com/kjd/idna/commit/1d365e17e10d72d0b7876316fc7b9ca0eebdd38d"
  • Network accessline 159
    {                   "type": "ADVISORY",                   "url": "https://github.com/advisories/GHSA-jjg7-2v4v-x38h"
  • Network accessline 160
    "type": "ADVISORY",                   "url": "https://github.com/advisories/GHSA-jjg7-2v4v-x38h"                 }
  • Network accessline 161
    "url": "https://github.com/advisories/GHSA-jjg7-2v4v-x38h"
  • Network accessline 174
    {                   "database_specific": {                     "source": "https://github.com/pypa/advisory-database/blob/main/vulns/idna/PYSEC-2026-215.yaml"
  • Network accessline 175
    "database_specific": {                     "source": "https://github.com/pypa/advisory-database/blob/main/vulns/idna/PYSEC-2026-215.yaml"                   },
  • Network accessline 176
    "source": "https://github.com/pypa/advisory-database/blob/main/vulns/idna/PYSEC-2026-215.yaml"
  • Network accessline 247
    {                   "type": "ADVISORY",                   "url": "https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx"
  • Network accessline 248
    "type": "ADVISORY",                   "url": "https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx"                 }
  • Network accessline 249
    "url": "https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx"

tests/fixtures/pip-audit/findings.json

  • Network accessline 10
    "CVE-2023-32681"           ],           "description": "### Impact  Since Requests v2.3.0, Requests has been vulnerable to potentially leaking `Proxy-Authorization` headers to destination servers, specifically during redirects to an HTTPS o
  • Network accessline 11
    ],           "description": "### Impact  Since Requests v2.3.0, Requests has been vulnerable to potentially leaking `Proxy-Authorization` headers to destination servers, specifically during redirects to an HTTPS origin. This is a product of
  • Network accessline 12
    "description": "### Impact  Since Requests v2.3.0, Requests has been vulnerable to potentially leaking `Proxy-Authorization` headers to destination servers, specifically during redirects to an HTTPS origin. This is a product of how `rebuild

tests/fixtures/pnpm/findings.json

  • Network accessline 34
    "patched_versions": ">=4.17.21",       "recommendation": "Upgrade to version 4.17.21 or later",       "references": "- https://nvd.nist.gov/vuln/detail/CVE-2021-23337\n- https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91d
  • Network accessline 35
    "recommendation": "Upgrade to version 4.17.21 or later",       "references": "- https://nvd.nist.gov/vuln/detail/CVE-2021-23337\n- https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c\n- https://snyk.io/vuln/SNYK
  • Network accessline 36
    "references": "- https://nvd.nist.gov/vuln/detail/CVE-2021-23337\n- https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c\n- https://snyk.io/vuln/SNYK-JS-LODASH-1040724\n- https://github.com/lodash/lodash/blob/ddf
  • Network accessline 39
    "title": "Command Injection in lodash",       "updated": "2025-08-12T21:44:25.000Z",       "url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm",
  • Network accessline 40
    "updated": "2025-08-12T21:44:25.000Z",       "url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm",       "vulnerable_versions": "<4.17.21"
  • Network accessline 41
    "url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm",
  • Network accessline 74
    "patched_versions": ">=4.17.21",       "recommendation": "Upgrade to version 4.17.21 or later",       "references": "- https://nvd.nist.gov/vuln/detail/CVE-2020-28500\n- https://github.com/lodash/lodash/pull/5065\n- https://github.com/lodas
  • Network accessline 75
    "recommendation": "Upgrade to version 4.17.21 or later",       "references": "- https://nvd.nist.gov/vuln/detail/CVE-2020-28500\n- https://github.com/lodash/lodash/pull/5065\n- https://github.com/lodash/lodash/pull/5065/commits/02906b8191d3
  • Network accessline 76
    "references": "- https://nvd.nist.gov/vuln/detail/CVE-2020-28500\n- https://github.com/lodash/lodash/pull/5065\n- https://github.com/lodash/lodash/pull/5065/commits/02906b8191d3c100c193fe6f7b27d1c40f200bb7\n- https://github.com/lodash/lodas
  • Network accessline 79
    "title": "Regular Expression Denial of Service (ReDoS) in lodash",       "updated": "2025-09-29T20:19:46.000Z",       "url": "https://github.com/advisories/GHSA-29mw-wpgm-hmr9",
  • Network accessline 80
    "updated": "2025-09-29T20:19:46.000Z",       "url": "https://github.com/advisories/GHSA-29mw-wpgm-hmr9",       "vulnerable_versions": ">=4.0.0 <4.17.21"
  • Network accessline 81
    "url": "https://github.com/advisories/GHSA-29mw-wpgm-hmr9",

tests/fixtures/runtime/node_core.json

  • Network accessline 4
    "CVE-2017-1000381"   ],   "ref": "https://nodejs.org/en/blog/vulnerability/july-2017-security-releases/",
  • Network accessline 5
    ],   "ref": "https://nodejs.org/en/blog/vulnerability/july-2017-security-releases/",   "vulnerable": "8.x || 7.x || 4.x || 6.x || 5.x",
  • Network accessline 6
    "ref": "https://nodejs.org/en/blog/vulnerability/july-2017-security-releases/",
  • Network accessline 21
    "patched": "^0.10.48 || ^0.12.17 || ^4.6.1",   "description": "ares_create_query single byte out of buffer write",   "ref": "https://c-ares.haxx.se/adv_20160929.html",
  • Network accessline 22
    "description": "ares_create_query single byte out of buffer write",   "ref": "https://c-ares.haxx.se/adv_20160929.html",   "overview": "A security vulnerability has been discovered in the c-ares library that is\nbundled with all versions of
  • Network accessline 23
    "ref": "https://c-ares.haxx.se/adv_20160929.html",
  • Network accessline 24
    "overview": "A security vulnerability has been discovered in the c-ares library that is\nbundled with all versions of Node.js. Due to the difficulty of triggering and\nmaking use of this vulnerability we currently consider this a low-severi
  • Network accessline 34
    "vulnerable": ">=6.0.0 <6.2.0 || 5.x || 4.x",   "patched": "^4.4.6 || ^5.12.0",   "ref": "https://nodejs.org/en/blog/vulnerability/june-2016-security-releases",
  • Network accessline 35
    "patched": "^4.4.6 || ^5.12.0",   "ref": "https://nodejs.org/en/blog/vulnerability/june-2016-security-releases",   "description": "Buffer overflow in V8",
  • Network accessline 36
    "ref": "https://nodejs.org/en/blog/vulnerability/june-2016-security-releases",
  • Network accessline 47
    "vulnerable": "5.x || 4.x",   "patched": "^5.10.0 || 4.4.2",   "ref": "https://github.com/npm/node/pull/6",
  • Network accessline 48
    "patched": "^5.10.0 || 4.4.2",   "ref": "https://github.com/npm/node/pull/6",   "overview": "Upgrade npm to fixes a security flaw in the use of\nauthentication tokens in HTTP requests that would allow an attacker to set up a\nserver that co
  • Network accessline 49
    "ref": "https://github.com/npm/node/pull/6",   "overview": "Upgrade npm to fixes a security flaw in the use of\nauthentication tokens in HTTP requests that would allow an attacker to set up a\nserver that could collect tokens from users of
  • Network accessline 60
    "vulnerable": "8.5.0",   "patched": "^8.6.0",   "ref": "https://nodejs.org/en/blog/vulnerability/september-2017-path-validation/",
  • Network accessline 61
    "patched": "^8.6.0",   "ref": "https://nodejs.org/en/blog/vulnerability/september-2017-path-validation/",   "overview": "Node.js version 8.5.0 included a change which caused a security vulnerability in the checks on paths made by some commu
  • Network accessline 62
    "ref": "https://nodejs.org/en/blog/vulnerability/september-2017-path-validation/",
  • Network accessline 75
    "publish_date": "2018-08-16",   "author": "\u0421\u043a\u043e\u0432\u043e\u0440\u043e\u0434\u0430 \u041d\u0438\u043a\u0438\u0442\u0430 \u0410\u043d\u0434\u0440\u0435\u0435\u0432\u0438\u0447 (Nikita Skovoroda / @ChALkeR)",   "ref": "https://
  • Network accessline 76
    "author": "\u0421\u043a\u043e\u0432\u043e\u0440\u043e\u0434\u0430 \u041d\u0438\u043a\u0438\u0442\u0430 \u0410\u043d\u0434\u0440\u0435\u0435\u0432\u0438\u0447 (Nikita Skovoroda / @ChALkeR)",   "ref": "https://nodejs.org/en/blog/vulnerability
  • Network accessline 77
    "ref": "https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/",
  • Network accessline 91
    "publish_date": "2018-08-16",   "author": "\u0421\u043a\u043e\u0432\u043e\u0440\u043e\u0434\u0430 \u041d\u0438\u043a\u0438\u0442\u0430 \u0410\u043d\u0434\u0440\u0435\u0435\u0432\u0438\u0447 (Nikita Skovoroda / @ChALkeR)",   "ref": "https://
  • Network accessline 92
    "author": "\u0421\u043a\u043e\u0432\u043e\u0440\u043e\u0434\u0430 \u041d\u0438\u043a\u0438\u0442\u0430 \u0410\u043d\u0434\u0440\u0435\u0435\u0432\u0438\u0447 (Nikita Skovoroda / @ChALkeR)",   "ref": "https://nodejs.org/en/blog/vulnerability
  • Network accessline 93
    "ref": "https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/",
  • Network accessline 105
    "vulnerable": "20.x || 22.x || 24.x",   "patched": "^20.19.4 || ^22.17.1 || ^24.4.1",   "ref": "https://nodejs.org/en/blog/vulnerability/july-2025-security-releases/",
  • Network accessline 106
    "patched": "^20.19.4 || ^22.17.1 || ^24.4.1",   "ref": "https://nodejs.org/en/blog/vulnerability/july-2025-security-releases/",   "description": "Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()",
  • Network accessline 107
    "ref": "https://nodejs.org/en/blog/vulnerability/july-2025-security-releases/",
  • Network accessline 119
    "vulnerable": "22.x || 24.x || 26.x",   "patched": "^22.23.2 || ^24.18.1 || ^26.5.1",   "ref": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
  • Network accessline 120
    "patched": "^22.23.2 || ^24.18.1 || ^26.5.1",   "ref": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",   "description": "Permission Model: --allow-fs-read/--allow-fs-write radix-tree prefix-boundary over-grant",
  • Network accessline 121
    "ref": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
  • Network accessline 133
    "vulnerable": "22.x || 24.x || 26.x",   "patched": "^22.23.2 || ^24.18.1 || ^26.5.1",   "ref": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
  • Network accessline 134
    "patched": "^22.23.2 || ^24.18.1 || ^26.5.1",   "ref": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",   "description": "HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP Parser",
  • Network accessline 135
    "ref": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
  • Network accessline 147
    "vulnerable": "22.x || 24.x || 26.x",   "patched": "^22.23.2 || ^24.18.1 || ^26.5.1",   "ref": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
  • Network accessline 148
    "patched": "^22.23.2 || ^24.18.1 || ^26.5.1",   "ref": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",   "description": "Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byt
  • Network accessline 149
    "ref": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",

tests/fixtures/semgrep/findings.json

  • Network accessline 105
    ],           "references": [             "https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions"
  • Network accessline 106
    "references": [             "https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions"           ],
  • Network accessline 107
    "https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions"
  • Network accessline 108
    ],           "shortlink": "https://sg.run/2LgAL",           "source": "https://semgrep.dev/r/yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag",
  • Network accessline 109
    "shortlink": "https://sg.run/2LgAL",
  • Network accessline 110
    "source": "https://semgrep.dev/r/yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag",
  • Network accessline 159
    ],           "references": [             "https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-ri[REDACTED]",
  • Network accessline 160
    "references": [             "https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-ri[REDACTED]",             "https://securitylab.github.com/research/github-actions-untrusted-input/
  • Network accessline 161
    "https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-ri[REDACTED]",
  • Network accessline 162
    "https://securitylab.github.com/research/github-actions-untrusted-input/"
  • Network accessline 163
    ],           "shortlink": "https://sg.run/pkzk",           "source": "https://semgrep.dev/r/yaml.github-actions.security.run-shell-injection.run-shell-injection",
  • Network accessline 164
    "shortlink": "https://sg.run/pkzk",
  • Network accessline 165
    "source": "https://semgrep.dev/r/yaml.github-actions.security.run-shell-injection.run-shell-injection",

tests/fixtures/trivy/findings.json

  • Network accessline 37
    "Message": "Specify a tag in the 'FROM' statement for image 'ubuntu'",           "Namespace": "builtin.dockerfile.DS001",           "PrimaryURL": "https://avd.aquasec.com/misconfig/ds-0001",
  • Network accessline 38
    "Namespace": "builtin.dockerfile.DS001",           "PrimaryURL": "https://avd.aquasec.com/misconfig/ds-0001",           "Query": "data.builtin.dockerfile.DS001.deny",
  • Network accessline 39
    "PrimaryURL": "https://avd.aquasec.com/misconfig/ds-0001",
  • Network accessline 40
    "Query": "data.builtin.dockerfile.DS001.deny",           "References": [             "https://avd.aquasec.com/misconfig/ds-0001"
  • Network accessline 41
    "References": [             "https://avd.aquasec.com/misconfig/ds-0001"           ],
  • Network accessline 42
    "https://avd.aquasec.com/misconfig/ds-0001"
  • Network accessline 57
    "Message": "Specify at least 1 USER command in Dockerfile with non-root user as argument",           "Namespace": "builtin.dockerfile.DS002",           "PrimaryURL": "https://avd.aquasec.com/misconfig/ds-0002",
  • Network accessline 58
    "Namespace": "builtin.dockerfile.DS002",           "PrimaryURL": "https://avd.aquasec.com/misconfig/ds-0002",           "Query": "data.builtin.dockerfile.DS002.deny",
  • Network accessline 59
    "PrimaryURL": "https://avd.aquasec.com/misconfig/ds-0002",
  • Network accessline 60
    "Query": "data.builtin.dockerfile.DS002.deny",           "References": [             "https://docs.docker.com/develop/develop-images/dockerfile_best-practices/",
  • Network accessline 61
    "References": [             "https://docs.docker.com/develop/develop-images/dockerfile_best-practices/",             "https://avd.aquasec.com/misconfig/ds-0002"
  • Network accessline 62
    "https://docs.docker.com/develop/develop-images/dockerfile_best-practices/",
  • Network accessline 63
    "https://avd.aquasec.com/misconfig/ds-0002"

tests/fixtures/yarn/findings.ndjson

  • Network accessline 1
    {"type":"auditAdvisory","data":{"resolution":{"id":1106913,"path":"lodash","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"4.17.20","paths":["lodash"]}],"found_by":null,"deleted":null,"references":"- https:
  • Network accessline 2
    {"type":"auditAdvisory","data":{"resolution":{"id":1108258,"path":"lodash","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"4.17.20","paths":["lodash"]}],"found_by":null,"deleted":null,"references":"- https:

tests/fixtures/zizmor/findings.json

  • Network accessline 68
    }     ],     "url": "https://docs.zizmor.sh/audits/#artipacked"
  • Network accessline 69
    ],     "url": "https://docs.zizmor.sh/audits/#artipacked"   },
  • Network accessline 70
    "url": "https://docs.zizmor.sh/audits/#artipacked"
  • Network accessline 162
    }     ],     "url": "https://docs.zizmor.sh/audits/#excessive-permissions"
  • Network accessline 163
    ],     "url": "https://docs.zizmor.sh/audits/#excessive-permissions"   }
  • Network accessline 164
    "url": "https://docs.zizmor.sh/audits/#excessive-permissions"

tests/test_check_runtime.py

  • Executable scriptline 1
    Executable file

tests/test_normalize_findings.py

  • Executable scriptline 1
    Executable file
  • Network accessline 702
    lock = json.loads((fixture / "package-lock.json").read_text()) 		lock["packages"]["node_modules/balanced-match"]["resolved"] = ( 			"https://github.com/example/balanced-match/archive/main.tgz")
  • Network accessline 703
    lock["packages"]["node_modules/balanced-match"]["resolved"] = ( 			"https://github.com/example/balanced-match/archive/main.tgz") 		lock_path = self.path_root / "package-lock.json"
  • Network accessline 704
    "https://github.com/example/balanced-match/archive/main.tgz")

tests/test_run_plan.py

  • Executable scriptline 1
    Executable file

tests/test_scan_plan.py

  • Executable scriptline 1
    Executable file

tests/test_validate_report.py

  • Executable scriptline 1
    Executable file

How the signals fit together

Facts from a static read of the files at the pinned commit. They describe what the code does, not why.

Some files could not be read; the facts below still hold.

Declared and executed: 3 facts
Signal confidence: 69 facts

and 19 more

Works with

Agent compatibility, from the files in this repository
AgentStatusEvidenceInstall to
Claude CodeNativeManifest .claude-plugin/plugin.json.claude/skills/<skill-name>/
CodexCompatibleStandard SKILL.md SKILL.md.agents/skills/<skill-name>/
CursorCompatibleStandard SKILL.md SKILL.md.cursor/skills/<skill-name>/
Gemini CLICompatibleStandard SKILL.md SKILL.md.gemini/skills/<skill-name>/
GitHub CopilotCompatibleStandard SKILL.md SKILL.md.github/skills/<skill-name>/
OpenCodeCompatibleStandard SKILL.md SKILL.md.opencode/skills/<skill-name>/
  • Native The repository ships a manifest, folder or frontmatter field for this agent.
  • Compatible A standard SKILL.md that this agent can read.
  • Unknown No evidence either way.

Derived automatically from paths, manifests and frontmatter. Not tested on each agent.

You might also use

tanviet12/vbsec

Security scanning skill for Claude Code, Codex and Antigravity. Finds the 21 most common vulnerabilities in AI-written code and shows how to fix each one.

323GitHub stars

ljagiello/ctf-skills

Agent skills for solving CTF challenges - web exploitation, binary pwn, crypto, reverse engineering, forensics, OSINT, and more

3.6kGitHub stars

chu0119/pojun-skill

Pojun 方法论蒸馏成的可移植 Agent Skill：三视角协议 + 三账本证据纪律 + L1-L4 证据分级 + 四层安全护栏 + SRC 打法速查，任意 AI Agent 即装即用 | Pojun pentest methodology as a portabl…

13GitHub stars

zhuyansen/agent-skills-hub

AgentSkillsHub (agentskillshub.top) — security-graded directory of open-source Claude skills, MCP servers & AI agent tools, refreshed every 8 hours

493GitHub stars

telagod/code-abyss

Give your AI coding agent a personality. Composable persona + style + skills for Claude Code, Codex, Gemini CLI & OpenClaw. Ships Tech Persona Card v1.0 spec.

244GitHub stars

zero-lab-ai/skills

Portable, evidence-bound security skills for authorized defensive assessment, red teaming, penetration testing, detection engineering, and engagement operations.

168GitHub stars