mcpField
S
security-scan

security-scan

github.com/fusengineSecurity3443 installsUpdated 2w ago
Repository

About security-scan

security-scan is a skill for scanning JavaScript/TypeScript, PHP, Python, Swift/iOS, Go, and Rust projects. It detects the language, runs matching OWASP-based checks, reports findings, and delegates proposed fixes to the sniper agent without applying them.

Key features

  1. 01Language detection from project markers
  2. 02OWASP-pattern vulnerability scanning
  3. 03Findings mapped to OWASP categories
  4. 04Structured scan reports
  5. 05Delegated fixes with file and line references

Use cases

  1. 01Scan a repository for common vulnerabilities
  2. 02Review GraphQL endpoints for security patterns
  3. 03Produce an OWASP-organized security report

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/fusengine/agents --skill security-scan

After installing, type/security-scanin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

references/
graphql-security.md
owasp-top10.md
scan-patterns-extra.md
scan-patterns.md
references/templates/
scan-report.md

Details

From the project README
This skill orchestrates a full security scan across JavaScript/TypeScript, PHP, Python, Swift/iOS, Go, and Rust: it detects the language from project markers, loads the matching pattern set, runs the harness's automated scanner (OWASP patterns ported into `@fusengine/harness`), maps findings to OWASP Top 10 categories, and generates a structured report.

Pattern categories include XSS, SQL injection, command injection, unsafe code execution (eval/exec), SSRF, weak cryptography, hardcoded secrets, insecure deserialization, and path traversal/LFI/RFI, plus GraphQL-specific patterns (introspection, depth/complexity limiting, batching, authorization) when a GraphQL endpoint is present.

After scanning, it delegates fixes to the sniper agent with file:line, vulnerability, and fix — it does not apply fixes itself.

Security Scan Skill

Overview

Orchestrates the full security scanning workflow across all supported languages.

Supported Languages

LanguageMarker FilesPattern Count
JavaScript/TypeScriptpackage.json25+
PHPcomposer.json20+
Pythonrequirements.txt, pyproject.toml18+
Swift/iOSPackage.swift, *.xcodeproj15+
Gogo.mod12+
RustCargo.toml10+

Workflow

  1. Detect language from project markers
  2. Load patterns from references/scan-patterns.md
  3. Run bun ${CLAUDE_PLUGIN_ROOT}/../node_modules/@fusengine/harness/dist/cli/bin.mjs scan <dir> for automated scanning (OWASP patterns ported into the harness)
  4. Map findings to OWASP categories via references/owasp-top10.md
  5. Generate report using references/templates/scan-report.md

Pattern Categories

  • XSS (Cross-Site Scripting)
  • SQL Injection
  • Command Injection
  • Code Execution (eval, exec)
  • SSRF (Server-Side Request Forgery)
  • Weak Cryptography
  • Hardcoded Secrets
  • Insecure Deserialization
  • Path Traversal / LFI / RFI

Integration

After scanning, delegate fixes to sniper:

Agent(subagent_type="fuse-ai-pilot:sniper", prompt="Security fixes: [FILE:LINE] [VULN] [FIX]")

References

Comments

Markdown supported