Does it work with both Python and JavaScript?

Absolutely; the skill provides specific implementation patterns for both the npm (JavaScript) and pip/safety (Python) ecosystems.

Can I use this to find exposed API keys?

Yes, the skill integrates with TruffleHog and Gitleaks to specifically detect hardcoded secrets, credentials, and API keys in your source code.

What security tools does this skill support?

The skill supports industry-standard tools including npm audit, pip-audit, Semgrep, Bandit, TruffleHog, Gitleaks, and Trivy.

Can it block insecure code from being committed?

Yes, it includes detailed configurations for pre-commit hooks that scan for secrets and vulnerabilities before code is committed to your repository.

How does it handle CI/CD integration?

It provides ready-to-use patterns for GitHub Actions and other CI tools, including logic to fail builds based on configurable severity thresholds.

Security Scanning

Name: Security Scanning
Author: yonatangross

byyonatangross

•

Seguridad y Pruebas

Automates vulnerability detection for dependencies, source code, and secrets to ensure production-ready security standards.

The Security Scanning skill empowers Claude Code to proactively identify and mitigate security risks across your entire development lifecycle. It provides automated workflows for auditing JavaScript and Python dependencies, performing Static Analysis Security Testing (SAST) with Semgrep and Bandit, and detecting exposed credentials using industry-leading tools like TruffleHog and Gitleaks. By integrating shift-left security practices—including pre-commit hooks and CI/CD thresholds—this skill ensures that your application remains resilient against vulnerabilities and credential leaks before code ever reaches production.

Características Principales

01Automated dependency auditing for npm and Python environments

02Container vulnerability scanning using Trivy integration

03Pre-commit hook configuration for automated security enforcement

0469 GitHub stars

05Static Analysis Security Testing (SAST) with Semgrep and Bandit

06Advanced secret detection to prevent API key and credential leakage

Casos de Uso

01Scanning repositories for accidentally committed secrets or environment variables

02Setting up shift-left security guardrails in a project's CI/CD pipeline

03Auditing a codebase for known vulnerabilities and outdated dependencies

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add yonatangross/orchestkit security-scanning

For use in Claude.ai and ChatGPT

Download Skill