security-scanner — code security scanner

Package scope and prerequisites

This catalog ships instructions, not the executable runtime. Python modules, scripts, local services and optional tools named below must be installed separately from the upstream project. Check their availability before running commands; if they are missing, explain the prerequisite instead of claiming execution or results. The host agent may use model tokens while following these instructions.

Détecte les patterns malveillants dans les skills Python, MCP servers, et pipelines. Combinaison de regex pattern-matching et d'analyse AST Python.

Usage

# Scanner un dossier
python -m skills.security_scanner.cli scan skills/ --fail-on critical
python -m skills.security_scanner.cli scan . --format json
python -m skills.security_scanner.cli scan src/main.py --verbose

# Audit complet
python -m skills.security_scanner.cli audit skills/ --format compact

Checks effectués

Architecture

security_scanner/
├── scanner.py     # Orchestrateur : itère fichiers, appelle analyseurs
├── patterns.py    # Base de patterns (regex + metadata)
├── ast_checker.py # Analyse Python AST
├── report.py      # Compilation du rapport
├── rules/         # YAML rules extensibles
├── cli.py         # CLI argparse
└── test_security_scanner.py

Intégration

# Pre-commit hook
python -m skills.security_scanner.cli scan . --fail-on critical --format compact

# CI/CD
python -m skills.security_scanner.cli scan skills/ --format json --output security-report.json

# Nightly audit
python -m skills.security_scanner.cli audit . --format markdown

Pitfalls

1. Faux positifs — eval dans un contexte contrôlé (ex: eval("1+1")) est signalé. L'AST checker permet de filtrer les évaluations statiques.
2. Fichiers binaires — Skip automatique (.pyc, .so, .dll, images).
3. Dossiers ignorés — .git, node_modules, pycache, .venv.
4. Performance — Utilise concurrent.futures pour scanner en parallèle.