|
1
|
--- |
|
2
|
name: security_scan |
|
3
|
description: Run runDependencyAudit, runSastScan, and runHoundDogScan and return a concise, prioritized security summary with critical/high findings first. Must use this skill if security scanning is explicitly requested by the user. |
|
4
|
--- |
|
5
|
|
|
6
|
# Security Scan Skill |
|
7
|
|
|
8
|
Run three independent scanners and summarize results: |
|
9
|
|
|
10
|
- `runDependencyAudit()` for package/dependency vulnerabilities |
|
11
|
- `runSastScan()` for static code findings |
|
12
|
- `runHoundDogScan()` for privacy/security dataflow findings |
|
13
|
|
|
14
|
## Orchestration |
|
15
|
|
|
16
|
For full scans, run scanners in parallel and tolerate per-scanner failures. |
|
17
|
|
|
18
|
```javascript |
|
19
|
const [depResult, sastResult, hounddogResult] = await Promise.allSettled([ |
|
20
|
runDependencyAudit(), |
|
21
|
runSastScan(), |
|
22
|
runHoundDogScan(), |
|
23
|
]); |
|
24
|
|
|
25
|
const dep = depResult.status === 'fulfilled' ? depResult.value : null; |
|
26
|
const sast = sastResult.status === 'fulfilled' ? sastResult.value : null; |
|
27
|
const hounddog = |
|
28
|
hounddogResult.status === 'fulfilled' ? hounddogResult.value : null; |
|
29
|
``` |
|
30
|
|
|
31
|
Do not fail the whole scan because one scanner errors. |
|
32
|
|
|
33
|
If a package install fails with HTTP 403 from `package-firewall.replit.local`, treat it as a likely security block and do not retry the same install. |
|
34
|
|
|
35
|
## Minimal Response Shape |
|
36
|
|
|
37
|
- `runDependencyAudit()` |
|
38
|
- `metadata.vulnerabilities`: `{ info, low, moderate, high, critical }` |
|
39
|
- `vulnerabilities[]`: `id`, `package`, `severity`, `fix`, `source` |
|
40
|
- `runSastScan()` |
|
41
|
- `results[]`: `checkId`, `message`, `severity`, `fingerprint`, `location` |
|
42
|
- `runHoundDogScan()` |
|
43
|
- `vulnerabilities[]`: `hash`, `ruleIds`, `message`, `severity`, `location`, `privacyViolations`, `remediation*` |
|
44
|
|
|
45
|
## Output Expectations |
|
46
|
|
|
47
|
Return concise results instead of dumping full payloads: |
|
48
|
|
|
49
|
1. Per scanner: status (`ok` or `error`) and count by severity. |
|
50
|
2. Top critical/high findings with file path and short message. |
|
51
|
3. A short remediation plan, with risky/breaking changes clearly called out. |