What is the 'Assume Breach' mindset used by the skill?

It's a core principle where the AI audits the system under the assumption that an attacker is already inside, focusing on zero-trust and defense-in-depth strategies.

Can it detect hardcoded secrets and API keys?

Yes, it scans for high-entropy patterns and specific prefixes for AWS, Azure, GCP, and common API token formats to prevent credential exposure.

What security standards does this skill follow?

The skill is aligned with the OWASP Top 10:2025 standards, covering modern risks like Software Supply Chain integrity and Exceptional Conditions handling.

How does it help prioritize which bugs to fix first?

It uses a risk matrix that combines CVSS severity scores with EPSS exploitability data and business context to categorize findings from Low to Critical.

Does this skill support automated scanning?

Yes, it includes runtime scripts like security_scan.py that can be executed via the Bash tool to perform automated validation of security principles.

Vulnerability Scanner

Name: Vulnerability Scanner
Author: claudiodearaujo

byclaudiodearaujo

•

Seguridad y Pruebas

Audits application codebases for security vulnerabilities using OWASP 2025 principles and automated scanning methodologies.

The Vulnerability Scanner skill transforms Claude into a security expert capable of identifying risks across the modern 2025 threat landscape. It employs a systematic four-phase approach—reconnaissance, discovery, analysis, and reporting—to uncover flaws like broken access control, supply chain weaknesses, and insecure design. By integrating automated validation scripts and a 'think like an attacker' mindset, it helps developers prioritize critical risks using CVSS and EPSS scores while providing clear, actionable remediation guidance for complex security issues.

Características Principales

01Supply Chain & Dependency Integrity Auditing

02OWASP Top 10:2025 Risk Mapping

03Attack Surface Mapping & Threat Modeling

04Automated Security Validation via Python Scripts

051 GitHub stars

06Risk Prioritization using CVSS and EPSS scoring

Casos de Uso

01Detecting hardcoded secrets, API keys, and cloud credentials in source code

02Reviewing CI/CD pipelines and lock files for supply chain vulnerabilities

03Conducting pre-deployment security audits for web applications and APIs

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add claudiodearaujo/sistema-de-narra-o-de-livro vulnerability-scanner

For use in Claude.ai and ChatGPT

Download Skill