Scan Projects for Security Vulnerabilities

Vulnerability Scanner teaches security-expert thinking for vulnerability scanning against the 2025 threat landscape: assume breach, zero trust, defense in depth, least privilege, and fail secure as core principles, applied via four threat-modeling questions - what are we protecting, who would attack, how would they attack, and what's the impact - before scanning begins. It ships a runtime validation script:

python scripts/security_scan.py <project_path>

Ten methodology areas follow. OWASP Top 10:2025's ten risk categories run A01 Broken Access Control through A10 Exceptional Conditions (new for 2025), with the 2025 changes noted explicitly: SSRF merged into A01, cloud/container misconfiguration (A02) elevated, Supply Chain (A03) and Exceptional Conditions (A10) newly added, and an overall shift toward root causes over symptoms. Supply Chain Security (A03) covers dependency, lock-file, build-pipeline, and registry attack vectors, defended by verifying package checksums, pinning versions, using private registries for critical dependencies, and signing artifacts. Attack Surface Mapping covers entry points, data flows, trust boundaries, and assets, scored via a Risk = Likelihood times Impact matrix. Risk Prioritization combines CVSS severity with EPSS exploit-likelihood through a decision tree: actively exploited (EPSS above 0.5) is CRITICAL regardless of CVSS, otherwise CVSS 9.0+ is HIGH and lower scores get scheduled by asset value. Exceptional Conditions (A10) distinguishes fail-open (bad - e.g. allowing access on an auth error) from fail-closed (good - denying access, rejecting bad input, limiting retries). A four-phase Scanning Methodology runs Reconnaissance, Discovery, Analysis, and Reporting.

Use this skill when performing vulnerability scanning, threat modeling, supply chain security review, attack surface mapping, risk prioritization (CVSS plus EPSS), or cloud security review against the OWASP Top 10:2025 framework.

Given a project to scan, the skill outputs findings each answering five questions - what, where (exact file/line/endpoint), why (root cause), impact, and how to fix - classified by severity (Critical: RCE, auth bypass, mass data exposure; High: data exposure, privilege escalation; Medium: limited scope requiring conditions; Low: informational). Code Pattern Analysis names specific high-risk patterns to search for: string concatenation in SQL queries, eval()/exec()/Function() dynamic code execution, pickle.loads()/unserialize() unsafe deserialization, user input in file paths (traversal), and disabled TLS verification - alongside secret-detection indicators like api_key/token/password naming and AWS_/AZURE_/GCP_ cloud prefixes.

Covers cloud security's shared-responsibility model (the scan target owns data and application-layer security, the provider owns infrastructure, OS/runtime ownership depends on the service model) with IAM least-privilege, public-storage-bucket, network security-group, and secrets-manager checks. Points to checklists.md for OWASP Top 10, Auth, API, and Data protection checklists. Named anti-patterns: scanning without mapping the attack surface first, alerting on every CVE instead of prioritizing by exploitability and asset value, ignoring false positives instead of maintaining a verified baseline, fixing symptoms instead of root causes, scanning once before deploy instead of continuously, and trusting third-party dependencies blindly instead of verifying integrity.

Security engineers and developers running vulnerability scans who want attacker-mindset threat modeling, OWASP Top 10:2025-aligned risk categories, and exploit-aware prioritization (CVSS plus EPSS) rather than an unprioritized CVE dump - especially teams that need coverage of the newer Supply Chain and Exceptional Conditions categories.