Individual skill

source-code-scanning

Security-focused source code review and SAST. Scans for vulnerabilities (OWASP Top 10, CWE Top 25), CVEs in third-party dependencies/packages, hardcoded secrets, malicious code, and insecure patterns. Use when given source code, a repo path, or asked to "audit", "scan", "review" code security, or "check dependencies for CVEs".

skills/source-code-scanning/SKILL.md

Read pinned source

Source commit 95fdc128af4ca1ae16b3226f9430f1bad97b0656

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: No
Repository scan complete: No
Skill scan complete: No
Observed behavior: Not checked yet
Last checked: Nov 5, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 610
Repository last updated: Jul 29, 2026
License: MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

bounty-hunters Repository topic
hackerone Repository topic
pentest Repository topic
pentest-tool Repository topic
security Repository topic
security-research Repository topic
security-tools Repository topic
security Derived category
security-application Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 4,623 bytes
SKILL.mdcore · 4,623 bytes
SKILL.mdcore · 4,623 bytes
SKILL.mdcore · 4,623 bytes
SKILL.mdcore · 4,623 bytes
reference/dependency-cve-scanning.mddoc · 3,722 bytes
reference/language-patterns.mddoc · 5,567 bytes
reference/malicious-code.mddoc · 4,479 bytes
reference/manual-review.mddoc · 6,707 bytes
reference/sast-tools.mddoc · 3,016 bytes
reference/secrets-detection.mddoc · 4,448 bytes

Read excerpt


# Source Code Security Review

## Quick Start

1. **Identify** - languages, frameworks, package managers present
2. **Automated SAST** - run tools appropriate to the stack
3. **Dependency CVEs** - scan lockfiles/manifests for known CVEs
4. **Secrets scan** - detect hardcoded credentials/tokens
5. **Manual review** - trace high-risk sinks (exec, eval, query, deserialize)
6. **Malicious code** - check for backdoors, obfuscation, suspicious network calls
7. **Report** - findings with CWE/CVE refs, severity, PoC, remediation

## Workflow