Debugging et maintenancesource GitHub
Analyse de sécurité
/security-scanAnalyse de code axée sur la sécurité. À lancer avant les commits et PRs pour détecter les vulnérabilités.
// contenu du skill
description: Security-focused code scan. Checks for hardcoded secrets, vulnerable dependencies, and common security issues.
Security Scan
Security-focused code scanning. Run before commits and PRs to catch vulnerabilities.
Phase 1: Secret Detection
Scan for hardcoded credentials:
bash
# Common secret patterns
grep -rn "password\s*[=:]\s*['\"]" --include=*.js --include=*.ts --include=*.py --include=*.go --include=*.java --include=*.rb . 2>/dev/null | grep -v node_modules | grep -v ".git"
grep -rn "api[_-]?key\s*[=:]\s*['\"]" --include=*.js --include=*.ts --include=*.py --include=*.go --include=*.java --include=*.rb . 2>/dev/null | grep -v node_modules
grep -rn "secret\s*[=:]\s*['\"]" --include=*.js --include=*.ts --include=*.py --include=*.go --include=*.java --include=*.rb . 2>/dev/null | grep -v node_modules
grep -rn "token\s*[=:]\s*['\"]" --include=*.js --include=*.ts --include=*.py --include=*.go --include=*.java --include=*.rb . 2>/dev/null | grep -v node_modules
# AWS keys
grep -rn "AKIA[0-9A-Z]{16}" . 2>/dev/null | grep -v node_modules
# Private keys
find . -name "*.pem" -o -name "*.key" -o -name "id_rsa" 2>/dev/null | grep -v node_modulesPhase 2: Dependency Audit
Check for vulnerable dependencies:
Node.js
bash
npm audit --json 2>/dev/null | head -100
# or
yarn audit --json 2>/dev/null | head -100Python
bash
pip-audit 2>/dev/null || safety check 2>/dev/nullGo
bash
govulncheck ./... 2>/dev/nullRust
bash
cargo audit 2>/dev/nullPhase 3: Code Pattern Analysis
Check for dangerous patterns:
SQL Injection
- String concatenation in SQL queries
- Unparameterized queries
- Dynamic table/column names from user input
Command Injection
- Shell execution with user input (
exec,system,subprocess) - Unsanitized path construction
XSS Vulnerabilities
innerHTMLwith user datadangerouslySetInnerHTMLwithout sanitization- Unescaped template variables
Path Traversal
- User input in file paths without sanitization
- Missing
..checks
Phase 4: Configuration Check
Verify security settings:
- [ ] Debug mode disabled in production configs
- [ ] HTTPS enforced (no HTTP URLs in prod)
- [ ] CORS properly configured
- [ ] Security headers present (CSP, X-Frame-Options, etc.)
- [ ] No default/weak passwords in configs
Output Format
## Security Scan: [PASS/FAIL/WARNINGS]
### Secrets Detected: [count]
1. **CRITICAL** - `file:line`
- Type: [API key/password/token/private key]
- Action: Remove immediately and rotate credential
### Vulnerable Dependencies: [count]
1. **[package@version]** - Severity: [Critical/High/Medium/Low]
- CVE: [CVE number if available]
- Fixed in: [version]
- Action: Update to [version]
### Code Vulnerabilities: [count]
1. **[Vulnerability Type]** - `file:line`
- Risk: [description]
- Fix: [remediation steps]
### Configuration Issues: [count]
1. **[Issue]**
- Current: [state]
- Recommended: [secure state]
### Recommendations
1. [Prioritized action items]NEVER Commit If
- Secrets detected in code (rotate and remove)
- Critical CVEs in dependencies (update first)
- Obvious injection vulnerabilities (fix first)
Usage
This command ships with the project-starter plugin. Invoke with: /project-starter:security-scan
// source originale publique
CloudAI-X/claude-workflow-v2/commands/security-scan.md
Licence : MIT License
Projet indépendant, non affilié à Anthropic. Ce skill reste la propriété de son auteur original.
