security-scan（安全扫描）

Security Scan

Purpose

Auto-detect and run available security scanning tools, producing a structured markdown report. Language-specific scanners activate automatically based on detected project files. Missing tools are skipped with installation guidance.

Scan Modes

Both modes scan the full directory tree. Pass --full when calling from a workflow that combines this skill with diff-scoped reviews (e.g., security-review) so the output header clearly identifies the scan scope.

Use --strict in CI pipelines or pre-commit hooks to fail the build when security findings are detected. Without --strict, the script always exits 0 after completing the scan (findings are reported in markdown output, but don't fail the pipeline).

Workflow

Step 1: Run the Scanner

Execute the bundled script from the project root:

# Default: scan full codebase
bash skills/security-scan/scripts/run-scans.sh [target-directory]

# Explicit full scan (identical result, intent is documented in output)
bash skills/security-scan/scripts/run-scans.sh --full [target-directory]

# Strict mode: exit non-zero if findings detected (for CI gates)
bash skills/security-scan/scripts/run-scans.sh --strict [target-directory]

If the skills directory is elsewhere, use the absolute path:

bash ~/.claude/skills/security-scan/scripts/run-scans.sh [--full] [--strict] [target-directory]

If the script is unavailable, run tools manually per the Manual Scan section.

Step 2: Review Raw Output

The script produces a markdown report. Parse each ## Tool: section:

• Status: Skipped — tool not installed, note for summary
• Status: Ran / No issues found — clean for this tool
• Status: Ran + findings — requires triage

Step 3: Triage Findings

For each finding:

1. Confirm it is in production code (not test fixtures or example files)
2. Check whether it is protected by existing validation or encoding
3. Classify severity: Critical / High / Medium / Low
4. Mark confirmed vs. likely false positive

Common false positives:

Step 4: Report

Present findings in this structure:

## Security Scan Summary

**Date**: <ISO 8601>
**Directory**: <path>
**Mode**: full | full (--full)
**Tools run**: N | **Tools skipped**: N | **Tools with findings**: N

### Confirmed Findings

| Severity | Tool      | Description                          | File / Location |
| -------- | --------- | ------------------------------------ | --------------- |
| Critical | gitleaks  | AWS key exposed in git history       | commit abc123   |
| High     | npm audit | lodash < 4.17.21 prototype pollution | package.json    |

### Likely False Positives

| Tool    | Description  | Reason dismissed              |
| ------- | ------------ | ----------------------------- |
| semgrep | eval() usage | Only in sandboxed test runner |

### Install Missing Tools

<list tools skipped with install commands>

Tool Coverage

Universal (always attempted)

Language-Specific (auto-detected)

Manual Scan

When the bundled script is unavailable, run each tool directly:

# Secrets
gitleaks detect --no-banner -v

# Static analysis
semgrep scan --config=auto --quiet

# Filesystem vulnerability scanning
grype dir:.

# Node.js
npm audit --omit=dev

# Python
bandit -r . -q --severity-level medium
pip-audit

# Go
gosec -quiet ./...
govulncheck ./...

# Rust
cargo audit

# Ruby
bundle-audit check --update

Integration

• security-review — use after this scan to perform AI-driven code analysis; pass --full to that skill to review the entire codebase alongside this full scan
• CI pipeline — run as a pre-merge gate using --strict to fail when findings are detected; without --strict, scans exit 0 (findings are reported in output only)

Bundled Resources