Vulnerability Scanner

​

Overview

​

What This Skill Provides

• Security Expert Mindset: Assume breach, zero trust, defense in depth
• OWASP Top 10:2025: Latest threat categories and changes
• Supply Chain Security: New A03 category for dependency attacks
• Attack Surface Mapping: Identifying and prioritizing entry points
• Risk Prioritization: CVSS + EPSS + business context
• Exceptional Conditions: New A10 category for fail-open vulnerabilities
• Code Pattern Analysis: Detecting high-risk code patterns
• Automated Scanning: Security validation scripts

​

Security Expert Mindset

​

Core Principles

​

Threat Modeling Questions

1. What are we protecting? (Assets)
2. Who would attack? (Threat actors)
3. How would they attack? (Attack vectors)
4. What’s the impact? (Business risk)

​

OWASP Top 10:2025

​

Risk Categories

​

2025 Key Changes

2021 → 2025 Shifts:
├── SSRF merged into A01 (Access Control)
├── A02 elevated (Cloud/Container configs)
├── A03 NEW: Supply Chain (major focus)
├── A10 NEW: Exceptional Conditions
└── Focus shift: Root causes > Symptoms

​

Supply Chain Security (A03)

​

Attack Surface

​

Defense Principles

• Verify package integrity (checksums)
• Pin versions, audit updates
• Use private registries for critical deps
• Sign and verify artifacts

​

Use Cases

​

When to Use This Skill

• Security auditing of applications
• Vulnerability assessment and penetration testing
• Code review for security issues
• Prioritizing security fixes
• Setting up security scanning in CI/CD
• Supply chain security analysis

​

Example Scenarios

1. Security Audit: “Scan this application for vulnerabilities”
2. Code Review: “Review this code for security issues”
3. Risk Assessment: “Prioritize these CVEs for our application”
4. Supply Chain: “Check dependencies for known vulnerabilities”

​

Attack Surface Mapping

​

What to Map

​

Prioritization Matrix

Risk = Likelihood × Impact

High Impact + High Likelihood → CRITICAL
High Impact + Low Likelihood  → HIGH
Low Impact + High Likelihood  → MEDIUM
Low Impact + Low Likelihood   → LOW

​

Risk Prioritization

​

CVSS + Context

​

Prioritization Decision Tree

Is it actively exploited (EPSS >0.5)?
├── YES → CRITICAL: Immediate action
└── NO → Check CVSS
         ├── CVSS ≥9.0 → HIGH
         ├── CVSS 7.0-8.9 → Consider asset value
         └── CVSS <7.0 → Schedule for later

​

Exceptional Conditions (A10 - New)

​

Fail-Open vs Fail-Closed

​

What to Check

• Exception handlers that catch-all and ignore
• Missing error handling on security operations
• Race conditions in auth/authz
• Resource exhaustion scenarios

​

Code Pattern Analysis

​

High-Risk Patterns

​

Secret Patterns

​

Scanning Methodology

​

Phase-Based Approach

1. RECONNAISSANCE
   └── Understand the target
       ├── Technology stack
       ├── Entry points
       └── Data flows

2. DISCOVERY
   └── Identify potential issues
       ├── Configuration review
       ├── Dependency analysis
       └── Code pattern search

3. ANALYSIS
   └── Validate and prioritize
       ├── False positive elimination
       ├── Risk scoring
       └── Attack chain mapping

4. REPORTING
   └── Actionable findings
       ├── Clear reproduction steps
       ├── Business impact
       └── Remediation guidance

​

Runtime Scripts

​

Reference Files

​

Cloud Security Considerations

​

Shared Responsibility

​

Cloud-Specific Checks

• IAM: Least privilege applied?
• Storage: Public buckets?
• Network: Security groups tightened?
• Secrets: Using secrets manager?

​

Anti-Patterns to Avoid

​

Reporting Principles

​

Finding Structure

1. What? - Clear vulnerability description
2. Where? - Exact location (file, line, endpoint)
3. Why? - Root cause explanation
4. Impact? - Business consequence
5. How to fix? - Specific remediation

​

Severity Classification

​

Related Skills

• red-team-tactics: Adversary simulation
• api-patterns: API security patterns
• clean-code: Secure coding practices
• code-review-checklist: Security in code reviews

​

Which Agents Use This Skill

• security-auditor: Primary user for security audits
• penetration-tester: Uses for security testing

​

Tools Available

• Read, Glob, Grep: For code analysis
• Bash: For running security tools