Scan the repository for hardcoded secrets, exposed API keys, insecure network configurations, and vulnerable dependencies. Use when the user asks for a security audit, secret detection, credential scan, vulnerability check, or wants to find leaked tokens in the codebase.
The English summary is being prepared. Showing the original description.
See how to installReview the instructions the agent will receive before you install.
Detect hardcoded secrets, insecure network patterns, and vulnerable dependencies in the repository using integrated scanning scripts.
Identify whether to scan the entire repo or specific subdirectories based on the user request.
bash .agents/skills/security/scripts/main_scan.sh
The scan checks three categories:
AKIA, sk-, ghp_, Bearer)http:// where https:// is expected)npm audit for vulnerable packagesIf the main script is unavailable, run checks manually:
# Secret patterns
grep -rn "AKIA\|sk-\|ghp_\|password\s*=\|api_key\s*=" --include="*.ts" --include="*.js" --include="*.env" .
# Insecure protocols
grep -rn "http://" --include="*.ts" --include="*.js" . | grep -v localhost
# Dependency vulnerabilities
npm audit --json
Organize results by severity:
| Severity | Examples |
|---|---|
| High | Exposed API keys, hardcoded passwords, leaked tokens |
| Medium | Insecure protocol usage, hardcoded IPs in production code |
| Low | Outdated dependencies with low-severity CVEs |
Provide actionable remediation for each finding (e.g., "Rotate this key and move to environment variable", "Upgrade package X to version Y").
CRITICAL: Never display a full secret in the output. Mask all sensitive values (e.g., AKIA...XXXX, sk-...abcd). Warn the user about the risk of committing secrets to version control.
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Skill for adding or updating educational algorithm guides, ensuring consistent patterns and simple explanations suitable for an 8-year-old.
The English summary is being prepared. Showing the original description.
Install and configure PostHog analytics SDK in React Native applications, including event tracking, feature flags, user identification, and error tracking. Use when the user needs to add PostHog analytics, session recording, or feature flags to a React Native app.
The English summary is being prepared. Showing the original description.
PostHog integration for React Router v6 applications
The English summary is being prepared. Showing the original description.
Develop and extend the RulCode technical interview preparation platform built with React, Vite, TypeScript, and Supabase. Use when adding new algorithm problems, building visualization components, implementing DSA topic pages, updating the problem editor, or modifying the interview preparation UI.
The English summary is being prepared. Showing the original description.
Skill for adding or updating system design guides tailored for college students and beginners, using simple analogies and no simulations.
The English summary is being prepared. Showing the original description.
React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.
The English summary is being prepared. Showing the original description.