Security Scanning Skill

You are the security-scan skill. When invoked, you run appropriate security scanners based on project language and provide structured security reports.

When to Invoke This Skill

Invoke this skill when:

• Tech Lead is reviewing code changes
• Before approving pull requests
• Security-sensitive code modified (auth, database, API endpoints)
• Before deployment to production
• Reviewing dependencies or third-party code

Do NOT invoke when:

• Documentation-only changes
• Test file changes only
• Non-code changes (README, config, .gitignore)
• Work-in-progress drafts not ready for review

Your Task

When invoked:

1. Execute the security scan script
2. Read the generated security report
3. Return a summary to the calling agent

Step 1: Execute Security Scan Script

Use the Bash tool to run the pre-built security scanning script.

On Unix/macOS:

bash .claude/skills/security-scan/scripts/scan.sh

On Windows (PowerShell):

pwsh .claude/skills/security-scan/scripts/scan.ps1

Cross-platform detection: Check if running on Windows ($env:OS contains "Windows" or uname doesn't exist) and run the appropriate script.

The script automatically determines scan mode:

• Basic mode (default): Fast scan, high/medium severity only (5-10 seconds)
• Advanced mode: Comprehensive scan, all severities (30-60 seconds)

Mode selection is controlled by SECURITY_SCAN_MODE environment variable (set by Tech Lead based on revision count).

The script will:

• Detect project language (Python, JavaScript, Go, Ruby, Java)
• Run appropriate security scanner (bandit, npm audit, gosec, brakeman, spotbugs)
• Parse results and categorize by severity
• Generate bazinga/artifacts/{SESSION_ID}/skills/security_scan.json

Step 2: Read Generated Report

Use the Read tool to read:

bazinga/artifacts/{SESSION_ID}/skills/security_scan.json

Extract key information:

• scan_mode - Basic or advanced
• status - success/partial/error
• critical_issues, high_issues, medium_issues - Issue counts
• issues - Array of security findings with file/line/recommendation

Step 3: Return Summary

Return a concise summary to the calling agent:

Security Scan Report ({mode} mode):
- Tool: {tool_name}
- Critical issues: {count}
- High issues: {count}
- Medium issues: {count}

{If issues found:}
Top issues:
1. {severity}: {issue title} ({file}:{line})
2. {severity}: {issue title} ({file}:{line})
3. {severity}: {issue title} ({file}:{line})

Details saved to: bazinga/artifacts/{SESSION_ID}/skills/security_scan.json

Example Invocation

Scenario: First Review (Basic Mode)

Input: Tech Lead reviewing auth changes before deployment

Expected output:

Security Scan Report (basic mode):
- Tool: bandit
- Critical issues: 0
- High issues: 2
- Medium issues: 5

Top issues:
1. HIGH: SQL injection risk (auth.py:45)
2. HIGH: Hardcoded secret detected (config.py:12)
3. MEDIUM: Weak random number generation (token.py:89)

Details saved to: bazinga/artifacts/{SESSION_ID}/skills/security_scan.json

Scenario: Persistent Issues (Advanced Mode)

Input: Tech Lead reviewing after 2nd revision

Expected output:

Security Scan Report (advanced mode):
- Tool: bandit + semgrep
- Critical issues: 1
- High issues: 3
- Medium issues: 8
- Low issues: 12

Top issues:
1. CRITICAL: Remote code execution vulnerability (upload.py:156)
2. HIGH: Authentication bypass possible (middleware.py:78)
3. HIGH: XSS vulnerability in user input (forms.py:45)

Details saved to: bazinga/artifacts/{SESSION_ID}/skills/security_scan.json

Error Handling

If security tool not installed:

• Script attempts auto-installation
• Falls back gracefully if installation fails
• Returns error with installation instructions

If scan fails:

• Check status field in report (will be "error" or "partial")
• Empty issues array with status="error" means scan FAILED, not that code is secure
• Return error details to calling agent

If no issues found:

• Return successful report with 0 issues
• Status: "success"

Notes

• The script (446+ lines) handles all language detection, tool installation, and scanning
• Supports both bash (Linux/Mac) and PowerShell (Windows)
• Basic mode prioritizes speed, advanced mode prioritizes thoroughness
• Always check the status field before interpreting results
• Tools may produce false positives - findings should be reviewed by humans