mcpField
S
security-scan

security-scan

github.com/fusengineSecurity3443 installsUpdated 2w ago
Repository

About security-scan

A security-scanning skill for projects written in JavaScript/TypeScript, PHP, Python, Swift/iOS, Go, and Rust. It detects the language, runs matching OWASP-based patterns, maps findings to OWASP Top 10 categories, and reports suggested fixes for a separate agent to handle.

Key features

  1. 01Language detection from project markers
  2. 02OWASP-based automated scanning
  3. 03OWASP Top 10 finding classification
  4. 04Structured scan reports
  5. 05GraphQL-specific security checks
  6. 06Delegation of fixes to sniper

Use cases

  1. 01Scanning a supported codebase for vulnerabilities
  2. 02Reviewing GraphQL endpoint security patterns
  3. 03Generating categorized security findings
  4. 04Handing findings to an agent for remediation

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/fusengine/claude-plugins --skill security-scan

After installing, type/security-scanin Claude Code to confirm it loaded.

Details

From the project README
This skill orchestrates a full security scan across JavaScript/TypeScript, PHP, Python, Swift/iOS, Go, and Rust: it detects the language from project markers, loads the matching pattern set, runs the harness's automated scanner (OWASP patterns ported into `@fusengine/harness`), maps findings to OWASP Top 10 categories, and generates a structured report.

Pattern categories include XSS, SQL injection, command injection, unsafe code execution (eval/exec), SSRF, weak cryptography, hardcoded secrets, insecure deserialization, and path traversal/LFI/RFI, plus GraphQL-specific patterns (introspection, depth/complexity limiting, batching, authorization) when a GraphQL endpoint is present.

After scanning, it delegates fixes to the sniper agent with file:line, vulnerability, and fix — it does not apply fixes itself.

Security Scan Skill

Overview

Orchestrates the full security scanning workflow across all supported languages.

Supported Languages

LanguageMarker FilesPattern Count
JavaScript/TypeScriptpackage.json25+
PHPcomposer.json20+
Pythonrequirements.txt, pyproject.toml18+
Swift/iOSPackage.swift, *.xcodeproj15+
Gogo.mod12+
RustCargo.toml10+

Workflow

  1. Detect language from project markers
  2. Load patterns from references/scan-patterns.md
  3. Run bun ${CLAUDE_PLUGIN_ROOT}/../node_modules/@fusengine/harness/dist/cli/bin.mjs scan <dir> for automated scanning (OWASP patterns ported into the harness)
  4. Map findings to OWASP categories via references/owasp-top10.md
  5. Generate report using references/templates/scan-report.md

Pattern Categories

  • XSS (Cross-Site Scripting)
  • SQL Injection
  • Command Injection
  • Code Execution (eval, exec)
  • SSRF (Server-Side Request Forgery)
  • Weak Cryptography
  • Hardcoded Secrets
  • Insecure Deserialization
  • Path Traversal / LFI / RFI

Integration

After scanning, delegate fixes to sniper:

Agent(subagent_type="fuse-ai-pilot:sniper", prompt="Security fixes: [FILE:LINE] [VULN] [FIX]")

References

Comments

Markdown supported