Comprehensive security vulnerability analysis for codebases and infrastructure. Scans dependencies (npm, pip, gem, go, cargo), containers (Docker, Kubernetes), cloud IaC (Terraform, CloudFormation), and detects secrets exposure. Fetches live CVE data from OSV.dev, calculates risk scores, and generates phased remediation plans with TDD validation tests. Use when users mention security scan, vulnerability, CVE, exploit, security audit, penetration test, OWASP, hardening, dependency audit, container security, or want to improve security posture.
Analyze environments for vulnerabilities, fetch current CVE/exploit data, and generate phased remediation plans with TDD validation.
When the user requests a security scan:
python .claude/skills/security-analyzer/scripts/discover_env.py .inventory.jsonpython .claude/skills/security-analyzer/scripts/fetch_vulns.py inventory.jsonscan_results.jsonpython .claude/skills/security-analyzer/scripts/generate_report.py scan_results.json inventory.jsonScan working directory for:
package.json, requirements.txt, Gemfile, go.mod, Cargo.toml, pom.xmlDockerfile, docker-compose.yml, kubernetes/*.yamlterraform/*.tf, cloudformation/*.yaml, *.bicep.env* files (flag exposure risk, never log values)Run the discovery script:
python .claude/skills/security-analyzer/scripts/discover_env.py /path/to/project > inventory.json
Fetch current threat data using the vulnerability scanner:
python .claude/skills/security-analyzer/scripts/fetch_vulns.py inventory.json > scan_results.json
| Source | Priority | Use For | |--------|----------|---------| | CISA KEV | 1 | Actively exploited vulns (use WebSearch) | | NVD | 2 | CVE details + CVSS scores (use WebSearch) | | GitHub Advisories | 3 | Package-specific vulns (use WebSearch) | | OSV.dev | 4 | Open source vulns (API in script) |
For CISA KEV and additional context, supplement with:
WebSearch: "CVE-XXXX-YYYY CISA KEV exploit"
The scanner calculates risk scores using:
Risk = (CVSS * 0.3) + (Exploitability * 0.3) + (Criticality * 0.2) + (Exposure * 0.2)
Exploitability: 10=CISA KEV, 7=public exploit, 3=theoretical
Criticality: 10=auth/payment, 5=core business, 2=logging
Exposure: 10=internet-facing, 5=internal, 2=air-gapped
Generate reports with fix commands and validation tests:
python .claude/skills/security-analyzer/scripts/generate_report.py scan_results.json inventory.json
Each finding includes:
Output two reports:
security-report-technical.md — Full details for engineerssecurity-report-executive.md — Summary for leadershipSee references/report-templates.md for output structure.
For each vulnerability, generate three test types:
def test_vuln_exists():
"""PASS before fix, FAIL after"""
assert is_vulnerable("component") == True
def test_fix_works():
"""Unit test for remediation code"""
result = apply_fix(vulnerable_config)
assert result.is_secure()
def test_vuln_resolved():
"""FAIL before fix, PASS after"""
assert is_vulnerable("component") == False
| Finding | Output |
|---------|--------|
| Dependency CVE | Version bump command + lockfile update |
| Container issue | Dockerfile patch |
| IaC misconfiguration | Terraform/K8s fix |
| Code vulnerability | Source patch + test |
| Secret exposure | Rotation commands + .gitignore update |
User: "Run a security scan on this project"
Claude:
npm install lodash@4.17.21)Search for places (restaurants, cafes, etc.) via Google Places API proxy on localhost.
Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Start voice calls via the OpenClaw voice-call plugin.
Notion API for creating and managing pages, databases, and blocks.
Gemini CLI for one-shot Q&A, summaries, and generation.
Category:developer