---

name: detecting-security-vulnerabilities description: Scans code for security vulnerabilities and unsafe patterns. Use when the user asks about security, mentions OWASP, credentials, secrets, XSS, SQL injection, or wants to audit code for threats.

Security Lint & Threat Detector

When to use this skill

• User asks to scan code for security issues
• User mentions OWASP vulnerabilities
• User wants to find leaked credentials or secrets
• User asks about XSS, SQL injection, or CSRF risks
• User wants to audit code before deployment

Workflow

• Identify files to scan (changed or full codebase)
• Run automated security scanners
• Perform pattern-based detection
• Categorize findings by severity
• Provide remediation suggestions
• Generate security report

Instructions

Step 1: Identify Scan Scope

For changed files:

Copygit diff --cached --name-only --diff-filter=ACMR | grep -E '\.(js|jsx|ts|tsx|py|rb|php|java|go)$'

For full codebase:

Copyfind src -type f \( -name "*.ts" -o -name "*.tsx" -o -name "*.js" -o -name "*.jsx" \)

Step 2: Run Security Scanners

JavaScript/TypeScript — npm audit:

Copynpm audit --json

JavaScript/TypeScript — Snyk (if available):

Copynpx snyk test --json

ESLint security plugin:

Copynpx eslint --plugin security --rule 'security/*: error' <files>

Semgrep (multi-language):

Copynpx @semgrep/semgrep --config=auto --json .

Gitleaks (secrets detection):

Copygitleaks detect --source . --report-format json

Step 3: Pattern-Based Detection

Scan for these high-risk patterns:

Credential Leakage

Copygrep -rn --include="*.{ts,js,tsx,jsx,json,env}" -E "AKIA[0-9A-Z]{16}" .
grep -rn --include="*.{ts,js,tsx,jsx}" -E "(api[_-]?key|apikey)\s*[:=]\s*['\"][^'\"]{16,}['\"]" .

Unsafe Code Patterns

Copygrep -rn --include="*.{ts,js,tsx,jsx}" -E "\beval\s*\(" .
grep -rn --include="*.tsx" "dangerouslySetInnerHTML" .
grep -rn --include="*.vue" "v-html" .
grep -rn --include="*.{ts,js}" -E "\.exec\s*\(.*\$\{" .

OWASP Top 10 Checks

Step 4: Categorize Findings

Severity levels:

Step 5: Generate Report

Format findings clearly:

Copy## Security Scan Report

### Critical (2)

#### 1. Hardcoded API Key

- **File**: src/api/client.ts:42
- **Pattern**: `apiKey = "sk_live_..."`
- **Risk**: Credential exposure in source control
- **Fix**: Move to environment variable

```typescript
// Before
const apiKey = "sk_live_abc123...";

// After
const apiKey = process.env.API_KEY;
```

2. SQL Injection Risk

• File: src/db/users.ts:23
• Pattern: String concatenation in query
• Risk: SQL injection allows data theft
• Fix: Use parameterized queries

Copy// Before
db.query(`SELECT * FROM users WHERE id = ${userId}`);

// After
db.query("SELECT * FROM users WHERE id = $1", [userId]);

High (1)

1. XSS via dangerouslySetInnerHTML

• File: src/components/Article.tsx:15
• Risk: User content rendered as HTML
• Fix: Sanitize with DOMPurify

Copyimport DOMPurify from "dompurify";
<div dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(content) }} />;

Summary

Copy
## Common Remediation Patterns

**Environment variables for secrets:**
```typescript
// Use dotenv or platform env
const secret = process.env.SECRET_KEY;
if (!secret) throw new Error('SECRET_KEY required');

Parameterized queries:

Copy// Prisma (safe by default)
await prisma.user.findUnique({ where: { id: userId } });

// Raw SQL with parameters
await db.query("SELECT * FROM users WHERE id = $1", [userId]);

XSS prevention:

Copy// React - avoid dangerouslySetInnerHTML
// If needed, sanitize first
import DOMPurify from "dompurify";
const clean = DOMPurify.sanitize(userContent);

CSRF protection:

Copy// Use CSRF tokens in forms
<input type="hidden" name="_csrf" value={csrfToken} />

// Validate on server
if (req.body._csrf !== req.session.csrfToken) {
  throw new Error('CSRF validation failed');
}

Secure headers:

Copy// Next.js next.config.js
const securityHeaders = [
  { key: "X-Content-Type-Options", value: "nosniff" },
  { key: "X-Frame-Options", value: "DENY" },
  { key: "X-XSS-Protection", value: "1; mode=block" },
  {
    key: "Strict-Transport-Security",
    value: "max-age=31536000; includeSubDomains",
  },
];

Validation

Before completing:

• All critical issues addressed
• High severity issues have remediation plan
• No secrets in committed code
• Dependencies updated for known CVEs
• Security headers configured

Error Handling

• Scanner not installed: Run npm install -g <tool> or use npx.
• Too many results: Filter by severity or scope to changed files.
• False positives: Review context before reporting; exclude test fixtures.
• Unsure about severity: Default to higher severity; security errs on caution.

Resources

• OWASP Top 10
• OWASP Cheat Sheet Series
• Semgrep Rules
• Snyk Vulnerability DB