Agent skill · security · aiskillstore
security-analyzer
Comprehensive security vulnerability analysis for codebases and infrastructure. Scans dependencies (npm, pip, gem, go, cargo), containers (Docker, Kubernetes), cloud IaC (Terraform, CloudFormation), and detects secrets exposure. Fetches live CVE data from OSV.dev, calculates risk scores, and generates phased remediation plans with TDD validation tests. Use when users mention security scan, vulnerability, CVE, exploit, security audit, penetration test, OWASP, hardening, dependency audit, container security, or want to improve security posture.
Why this skill is useful
Adds executable scripts for comprehensive security analysis and remediation that aren't available in public documentation.
What it needs
Requires python installed locally. About 2k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Security Analyzer Analyze environments for vulnerabilities, fetch current CVE/exploit data, and generate phased remediation plans with TDD validation. Quick Start When the user requests a security scan: 1. Run environment discovery: python .claude/skills/security-analyzer/scripts/discoverenv.py . 2. Save output to inventory.json 3. Run vulnerability scan: python .claude/skills/security-analyzer/scripts/fetchvulns.py inventory.json 4. Save output to scanresults.json 5. Generate reports: python .claude/skills/security-analyzer/scripts/generatereport.py scanresults.json inventory.json Workflow Phase 1: Environment Discovery Scan working directory for: Dependencies: package.json, requirements.txt, Gemfile, go.mod, Cargo.toml, pom.xml Containers: Dockerfile, docker-compose.yml, kubernetes/.yaml Cloud IaC: terraform/.tf, cloudformation/.yaml, .bicep Secrets: .env files (flag exposure risk, never log values) Run the discovery script: Phase 2: Vulnerability Intelligence Fetch current threat data using the vulnerability scanner: Source Priority Use For -------- ---------- --------- CISA KEV 1 Actively exploited vulns (use WebSearch) NVD 2 CVE details + CVSS scores (use WebSearch) GitHub Advisories 3 Package-specific vulns (use WebSearch) OSV.dev 4 Open source vulns (API in script) For CISA KEV and additional context, supplement with: Phase 3: Risk Scoring The scanner calculates risk scores using: Phase 4: Phased Remediation Generate reports with fix commands and validation tests: Each finding includes: 1. Vulnerability details + risk score 2. Actual fix code/patch (not just recommendations) 3. Pre-fix test (proves vuln exists) 4. Remediation unit tests (tests the fix code) 5. Post-fix validation (proves vuln resolved) Phase 5: Reports Output two reports: security-report-technical.md — Full details for engineers security-report-executive.md — Summary for leadership See references/report-templates.md for output structure. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/security-analyzer