---
name: vulnerability-scanner
description: Hunt for concrete, exploitable vulnerabilities - OWASP Top 10 patterns, hardcoded secrets, vulnerable dependencies and CVEs, SSRF, path traversal. Use for /probe, dependency audits, or "find the flaws" requests.
metadata: {"navin":{"emoji":"🐞","category":"security"}}
---

# Vulnerability Scanner

## Overview

Focused flaw hunting: unlike a broad security audit, this skill targets **specific exploitable weaknesses** with proof. Every finding needs a location, a reproduction sketch, and the minimal patch. Read-only by default.

## Scan targets

| Class | What to grep / check |
|-------|----------------------|
| Injection | string-built SQL, `shell=True`, template injection, `eval`/`Function()` |
| Secrets | AWS/GCP keys, JWT secrets, API tokens, private keys, DB URLs in code or history |
| Dependencies | lockfile versions vs CVE databases (`npm audit`, `pip-audit`, `osv-scanner`, `cargo audit`) |
| SSRF | user-supplied URLs passed to `fetch`/`requests`/`httpx` without allowlist |
| Path traversal | user paths joined without normalization + containment check |
| Deserialization | `pickle.loads`, `yaml.load` (no SafeLoader), `ObjectInputStream` |
| XSS | `innerHTML`, `dangerouslySetInnerHTML`, unescaped template output |
| Auth flaws | JWT `alg:none`, missing signature verification, predictable tokens |
| Prompt injection | LLM tools that pass web/file content into system-level instructions |

## Workflow

1. Call `security_scan(kind=full)` (or `sast` / `secrets` / `sca` for a focused Action) before manual greps.
2. Inventory the stack (languages, frameworks, lockfiles) for any remaining scanners not covered.
3. Run extra CLIs via exec when present (`osv-scanner`, `cargo audit`, `trivy`), then pattern sweeps for what tools miss.
4. For each hit, **verify exploitability**: trace the input path, check existing sanitization, confirm the vulnerable version is actually in the dependency tree. Add `malicious_input_example` when possible.
5. Deduplicate and rate: Critical (remote exploit / secret leak), High, Medium, Low.
6. Report format per finding:
   - `[SEVERITY] title` - file:line
   - Proof: the code path or dependency chain
   - Impact: what an attacker gains
   - Fix: the minimal diff or version bump
7. End with a summary table and the recommended fix order.

## Anti-patterns

- Flagging a vulnerable version that is not actually resolved in the lockfile
- Reporting sanitized inputs as injections
- Copy-pasting scanner output without verification
- Fixing code during the scan without an explicit request