Security Scan

Detect hardcoded secrets, insecure network patterns, and vulnerable dependencies in the repository using integrated scanning scripts.

Workflow

1. Determine scope

Identify whether to scan the entire repo or specific subdirectories based on the user request.

2. Run the scan

bash .agents/skills/security/scripts/main_scan.sh

The scan checks three categories:

• Secret detection: Hardcoded API keys, tokens, passwords, and credentials (e.g., patterns like AKIA, sk-, ghp_, Bearer)
• Network check: Hardcoded IP addresses and insecure protocol usage (http:// where https:// is expected)
• Dependency audit: npm audit for vulnerable packages

If the main script is unavailable, run checks manually:

# Secret patterns
grep -rn "AKIA\|sk-\|ghp_\|password\s*=\|api_key\s*=" --include="*.ts" --include="*.js" --include="*.env" .

# Insecure protocols
grep -rn "http://" --include="*.ts" --include="*.js" . | grep -v localhost

# Dependency vulnerabilities
npm audit --json

3. Report findings

Organize results by severity:

Severity	Examples
High	Exposed API keys, hardcoded passwords, leaked tokens
Medium	Insecure protocol usage, hardcoded IPs in production code
Low	Outdated dependencies with low-severity CVEs

Provide actionable remediation for each finding (e.g., "Rotate this key and move to environment variable", "Upgrade package X to version Y").

4. Safety

CRITICAL: Never display a full secret in the output. Mask all sensitive values (e.g., AKIA...XXXX, sk-...abcd). Warn the user about the risk of committing secrets to version control.