agentleFS
Sign inStart free
NikoxkxNikoxkx/Agent-Skills/skills/security/vulnerability-scanner/SKILL.md

vulnerability-scanner

Skill1 starsChanged 5 months agoApache-2.0View on GitHub

Runs automated vulnerability scans on codebases, dependencies, and containers. Use when auditing security before deployment or after adding new dependencies.

16 other projects use a version of this.

Adopted by

Most recently taken up by

Used with

Projects with it also use nextjs-react-expert, intelligent-routing and 6 more.

Other files people use alongside this one.

Files found in the same public projects as a version of this one, more often than they turn up anywhere else. Each project counts once, large collections count for less, and this file's own repository is left out.
  • SKB3002Skill

    nextjs-react-expert

    React and Next.js performance optimization from Vercel Engineering. Use when building React components, optimizing performance, eliminating waterfalls, reducing bundle size, reviewing code for performance issues, or implementing server/client-side optimizations.

    Also in 3 projects that use this

  • SKB3002Skill

    intelligent-routing

    Automatic agent selection and intelligent task routing. Analyzes user requests and automatically selects the best specialist agent(s) without requiring explicit user mentions.

    Also in 4 projects that use this

  • goca-seSkill

    batch-operations

    Apply a change safely across many files — refactors touching more than 5 files, library or API migrations, project-wide renames of symbols/imports/paths, or adding boilerplate to many files. Use when "do it all at once" risks context overflow or silent failures.

    Also in 3 projects that use this

  • sefaertuncSkill

    coordinator-mode

    Multi-agent orchestration patterns: when to use coordinator mode, worker prompts, parallel execution

    Also in 3 projects that use this

  • xfstudioSkill

    rust-pro

    Master Rust 1.75+ with modern async patterns, advanced type system

    Also in 3 projects that use this

  • Dimks777Skill

    memory-system

    Развёртывание и обслуживание 3-слойной системы памяти для любого агента OpenClaw — чтобы контекст переживал сессии. Активируется на: настрой память, memory setup, проверь память, memory check, почисти память, memory cleanup, память.

    Also in 3 projects that use this

The file

We split this skill into the rules it gives an agent

5 rules. 0 are common, 4 are distinctive, and 1 is very specific to this project.

  • 0

    Common

    Most of the 16 edited versions we read keep these.

  • 4

    Distinctive

    This author's own choices. Worth a look.

  • 1

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Distinctive:

    Before merging or deploying code that touches dependencies or infrastructure.

    line 19
  2. Distinctive:

    After adding or updating third-party packages.

    line 20
  3. Very specific:

    False positives: Document how to suppress with justification (.snyk policy, # nosec, etc.).

    line 72
  4. Distinctive:

    No internet in CI: Use local vulnerability DBs or cached scans where possible.

    line 74
  5. Distinctive:

    Run the scanner(s) on the current codebase — results are produced.

    line 78

“Common” is measured: kept by at least 6 in 10 of the 16 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

Overview

Runs and interprets automated vulnerability scans across code (SAST), dependencies (SCA), containers/images, and infrastructure. Covers tool selection (Snyk, Trivy, Bandit, npm/pip audit, OWASP Dependency-Check, Semgrep), command reference, output interpretation, CVSS severity, remediation priority, CI integration, and a pre-deploy security gate workflow.

When to Use This Skill

  • Before merging or deploying code that touches dependencies or infrastructure.
  • After adding or updating third-party packages.
  • As part of regular security hygiene or compliance prep.
  • The user mentions "scan for vulnerabilities", "security audit", "CVE", or "Snyk/Trivy".

Prerequisites

  • The codebase or container image to scan.
  • Tools installed or available via Docker (Trivy, etc.).
  • (Recommended) CI pipeline to run scans on every PR and on main.

Steps

  1. Choose the right tool(s) for the target:
    • Dependencies (SCA): Snyk, npm audit, pip-audit, cargo audit, OWASP Dependency-Check.
    • Code (SAST): Semgrep, Bandit (Python), gosec (Go), SonarQube, CodeQL.
    • Containers / IaC: Trivy (images + Terraform/K8s), Checkov, Terrascan.
    • Secrets: gitleaks, truffleHog (see secret-detector skill).
  2. Run the scan (examples):
    • trivy image myapp:latest
    • snyk test (after snyk auth)
    • bandit -r src/
    • npm audit --audit-level=moderate
  3. Interpret results:
    • CVSS 3.x / 4.0 scoring (Critical 9.0-10, High 7.0-8.9, etc.).
    • Reachability / exploitability (Snyk and some tools show this).
    • False positive filtering (common in SAST).
  4. Prioritize remediation:
    • Critical/High with known exploits in your environment → immediate.
    • Medium → within sprint or before next release.
    • Low → backlog or accept with justification.
  5. CI integration:
    • Fail the build on Critical/High (configurable threshold).
    • Upload reports as artifacts.
    • Comment on PRs with findings (or use Snyk PR checks).
  6. Output:
    • Exact commands for the languages/tools in the project.
    • Sample output + how to read it.
    • Recommended CI step (GitHub Action example).
    • Remediation workflow (how to fix a vulnerable dependency safely).
    • Policy: "No Critical or High in main".

Examples

Full commands + GitHub Actions job for a typical Node + Python + Docker project using Trivy + Snyk + Bandit, with severity thresholds and artifact upload, plus a sample remediation PR description are included.

Edge Cases & Error Handling

  • False positives: Document how to suppress with justification (.snyk policy, # nosec, etc.).
  • Transitive dependencies: Tools usually surface them; focus on direct where possible.
  • No internet in CI: Use local vulnerability DBs or cached scans where possible.

Verification

  1. Run the scanner(s) on the current codebase — results are produced.
  2. CI job fails (or warns) on injected high-severity issues.
  3. A known vulnerable dependency is detected and a fix PR is created.
  4. Reports are attached to the build for audit.
  5. Success: Critical and High vulnerabilities are caught before they reach production, and the team has a clear process to remediate.

References

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free