Loading...
Loading...
Scans code for security vulnerabilities, identifies CVE patterns, and provides severity ratings with remediation guidance. Use when scanning for security issues, code vulnerabilities, or OWASP top 10 problems.
npx skill4agent add armanzeroeight/fastagent-plugins vulnerability-scanner# For JavaScript/TypeScript
npx eslint --plugin security .
# For Python
bandit -r . -f json
# For general patterns
grep -rn "eval\|exec\|system\|shell" --include="*.py" --include="*.js"package.jsonrequirements.txtpyproject.tomlgo.modCargo.tomlnpx eslint --plugin security --ext .js,.ts,.jsx,.tsx .pip install bandit
bandit -r . -f json -o bandit-report.jsongo install golang.org/x/vuln/cmd/govulncheck@latest
govulncheck ./...| Pattern | Risk | Languages |
|---|---|---|
| Code injection | JS, Python |
| Command injection | Python |
| Command injection | Python |
| XSS | React |
| SQL string concatenation | SQL injection | All |
| Deserialization | Python |
## Security Scan Results
### Critical (0)
[None found]
### High (2)
1. **SQL Injection** - src/db/queries.js:45
- Pattern: String concatenation in SQL query
- Fix: Use parameterized queries
2. **XSS Vulnerability** - src/components/Comment.jsx:23
- Pattern: dangerouslySetInnerHTML with user input
- Fix: Sanitize input with DOMPurify// BAD: SQL Injection
const query = `SELECT * FROM users WHERE id = ${userId}`;
// GOOD: Parameterized query
const query = 'SELECT * FROM users WHERE id = ?';
db.query(query, [userId]);// BAD: Direct HTML insertion
element.innerHTML = userInput;
// GOOD: Text content or sanitization
element.textContent = userInput;
// or
element.innerHTML = DOMPurify.sanitize(userInput);