New: 97,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Source Code Scanning

by transilienceai in transilienceai/communitytools

Security-focused source code review and SAST. An agent skill from transilienceai/communitytools.

MITAuto-check: notesSecurity

Install Source Code Scanning

skills CLI
$ npx skills add transilienceai/communitytools --skill source-code-scanning -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install transilienceai/communitytools source-code-scanning --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/transilienceai/communitytools.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/source-code-scanning .claude/skills/source-code-scanning && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
source-code-scanning
GitHub stars
559
Token cost
~1.2k tokens
SKILL.md length
409 words
Files
7
Skills in repo
35
Repo updated
First seen
Licence
MIT

At a glance

Security-focused source code review and SAST. An agent skill from transilienceai/communitytools.

  • Works in 6 steps: Enumerate → Automated SAST → Dependency CVE Scan → …
  • Given source code
  • SKILL.md covers Quick Start, Workflow, Language-Specific Patterns and Severity Mapping, plus 3 more sections
  • Calls gitleaks, semgrep and gh

What it does

Source Code Scanning is an agent skill from transilienceai/communitytools. Security-focused source code review and SAST. Scans for vulnerabilities (OWASP Top 10, CWE Top 25), CVEs in third-party dependencies/packages, hardcoded secrets, malicious code, and insecure patterns. Use when given source code, a repo path, or asked to "audit", "scan", "review" code security, or "check dependencies for CVEs".

Its SKILL.md is about 1.2k tokens, which your agent loads only when the skill is triggered. The skill folder holds 7 other files (for example `reference/dependency-cve-scanning.md`, `reference/language-patterns.md` and `reference/malicious-code.md`).

It sits in Security, covering Static analysis and SAST, Vulnerability scanning and Code review. The repository describes itself as: Open-source Claude Code skills, agents, and slash commands for AI-powered penetration testing, bug bounty hunting, and security research. The licence is MIT.

When your agent uses it

  • Given source code
  • Review code security
  • Check dependencies for CVEs

Example prompts

  • “review”
  • “check dependencies for CVEs”
  • “/source-code-scanning”

Requirements

  • Python 3

Workflow steps

6 steps, taken from the step headings in SKILL.md.

  1. Enumerate
  2. Automated SAST
  3. Dependency CVE Scan
  4. Secrets Detection
  5. Manual Review
  6. Malicious Code

What it can do on your machine

Read from SKILL.md and the folder at commit 95fdc12. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • gitleaks
    • semgrep
    • gh
    • npm
    • yarn
    • bundle
    • trivy

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use gh, npm and yarn, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Source Code Scanning loads about 1.2k tokens when it runs. Until then it costs about 87 tokens; SKILL.md has 409 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~87
When it runs · the whole SKILL.md, loaded when a task matches
~1.2k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

  • NoteMentions a .env fileSKILL.md:25
    - Config files: .env*, config.*, settings.*, *.yaml, *.toml

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from transilienceai/communitytools at commit 95fdc12, republished under its MIT licence (© transilienceai). 409 words, ~1,155 tokens.

Download SKILL.mdSave it as .claude/skills/source-code-scanning/SKILL.md (or your agent's skills folder). This skill also uses 6 other files; get the full folder from GitHub.
name
source-code-scanning
description
Security-focused source code review and SAST. Scans for vulnerabilities (OWASP Top 10, CWE Top 25), CVEs in third-party dependencies/packages, hardcoded secrets, malicious code, and insecure patterns. Use when given source code, a repo path, or asked to "audit", "scan", "review" code security, or "check dependencies for CVEs".

Source Code Security Review

Quick Start

  1. Identify - languages, frameworks, package managers present
  2. Automated SAST - run tools appropriate to the stack
  3. Dependency CVEs - scan lockfiles/manifests for known CVEs
  4. Secrets scan - detect hardcoded credentials/tokens
  5. Manual review - trace high-risk sinks (exec, eval, query, deserialize)
  6. Malicious code - check for backdoors, obfuscation, suspicious network calls
  7. Report - findings with CWE/CVE refs, severity, PoC, remediation

Workflow

Phase 1: Enumerate
- Languages: ls **/*.{py,js,ts,java,go,rb,php,cs,rs}
- Packages: find package.json, requirements.txt, go.mod, pom.xml, Gemfile, composer.json, Cargo.toml
- Entry points: main(), index.*, app.*, server.*
- Config files: .env*, config.*, settings.*, *.yaml, *.toml
Phase 2: Automated SAST

See sast-tools.md for commands per language.

Key tools:

  • Multi-language: Semgrep (semgrep --config=auto .)
  • Python: Bandit (bandit -r . -f json)
  • JavaScript/TS: ESLint security plugin, njsscan
  • Java: SpotBugs + FindSecBugs
  • Go: gosec (gosec ./...)
  • PHP: PHPCS Security Audit
  • Ruby: Brakeman (brakeman -o report.json)
  • All: CodeQL (via gh codeql)
Phase 3: Dependency CVE Scan

See dependency-cve-scanning.md for commands.

EcosystemCommand
npm/yarnnpm audit --json / yarn audit
Pythonpip-audit -r requirements.txt
Javadependency-check --scan .
Gogovulncheck ./...
Rubybundle audit
Generictrivy fs . / grype dir:.
Phase 4: Secrets Detection

See secrets-detection.md.

bash
trufflehog filesystem . --json
gitleaks detect --source . -v
Phase 5: Manual Review

Focus on high-risk sinks — see manual-review.md:

  • Injection sinks: exec, eval, query, system, popen
  • Deserialization: pickle.loads, ObjectInputStream, unserialize
  • Crypto: hardcoded keys, weak algorithms (MD5, SHA1, DES, ECB)
  • Auth: JWT validation, session management, RBAC enforcement
  • File ops: path construction with user input
Phase 6: Malicious Code

See malicious-code.md:

  • Obfuscated strings (base64, hex, charCode)
  • Unexpected network calls in library code
  • Typosquatting indicators
  • Postinstall/lifecycle script abuse
  • Hidden backdoors in dependencies

Language-Specific Patterns

See language-patterns.md for Python, JS, Java, Go, PHP, Ruby.

Show full SKILL.md (172 more words)Show less

Severity Mapping

SeverityCVSSExamples
Critical9.0+RCE, SQLi with exfil, auth bypass
High7.0-8.9Stored XSS, SSRF, insecure deserialization
Medium4.0-6.9Reflected XSS, info disclosure, IDOR
Low0.1-3.9Missing headers, verbose errors

Output Format

findings/
  <severity>-<vuln-type>-<location>.md   # One file per finding
evidence/
  <tool>-output.json                      # Raw tool output
summary-report.md                         # Executive summary

Each finding: CWE/CVE ID | File:Line | Severity | PoC | Remediation

Mobile App Analysis (APK/IPA)

When given a mobile app binary:

  1. Extract: unzip app.apk -d extracted/ (APKs are ZIP archives)
  2. Identify framework: React Native (assets/index.android.bundle), Flutter (libflutter.so), Xamarin, or native
  3. React Native: JS bundle is plaintext — search for secrets, API keys, config objects, hardcoded tokens
  4. Encoded secrets: Search for base64 prefixes of known flag/secret formats (e.g., RkxBR = base64 of FLAG). Config objects often store secrets as base64 in debug, secret, apiKey fields
  5. Native: Use jadx for Java/Kotlin decompilation, check AndroidManifest.xml, strings.xml, BuildConfig
  6. Shared libs: Check .so files with strings for hardcoded credentials

Critical Rules

  • Never execute untrusted code during review
  • Treat all findings as potential until verified
  • Always cross-reference CVEs against actual version in use
  • Report supply chain issues separately (they affect all users)

© transilienceai, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 6 other files in skills/source-code-scanning of transilienceai/communitytools.

  • SKILL.md
  • reference/dependency-cve-scanning.md
  • reference/language-patterns.md
  • reference/malicious-code.md
  • reference/manual-review.md
  • reference/sast-tools.md
  • reference/secrets-detection.md

Open the folder on GitHubat commit 95fdc12

Compare with similar skills

Source Code Scanning next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Source Code Scanning compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Source Code Scanning this skilltransilienceai/communitytools559—~1.2kAutomated safety check: NotesMIT
Golang Securityunxed/f42402 repos~3.6kAutomated safety check: PassMIT
Security Auditoreigent-ai/eigent15k—~1.8kAutomated safety check: NotesApache-2.0
Security Verification Gatefengshao1227/ccg-workflow5.9k—~621Automated safety check: NotesMIT
Secknowledge SkillPa55w0rd/secknowledge-skill423—~2.7kAutomated safety check: PassNone
Cyber NeoHainrixz/cyber-neo281—~5.9kAutomated safety check: WarnMIT

Similar skills

  • Golang Security

    unxed/f4

    Security best practices and vulnerability prevention for Golang — injection (SQL, command, XSS), cryptography, path traversal, SSRF and HTTP security headers, cookies, secrets management, memory…

    240 GitHub starsUsed in 2 repos~3.6k tokens
    SecurityAuto-check passed

  • Security Auditor

    eigent-ai/eigent

    Audits source code, dependencies and config files for vulnerabilities and hardcoded secrets, using two bundled Python scanners and an OWASP Top 10 checklist.

    15k GitHub stars~1.8k tokensUpdated yesterday
    SecurityAuto-check: notes

  • Security Verification Gate

    fengshao1227/ccg-workflow

    Scans code with a bundled Node script for injection, secrets, XSS and other risky patterns, ranks findings by severity and checks that security decisions are documented.

    5.9k GitHub stars~621 tokensUpdated 22 days ago
    SecurityAuto-check: notes

  • Secknowledge Skill

    Pa55w0rd/secknowledge-skill

    Web+AI 安全测试知识库。融合 WooYun 88,636 案例 + 先知 L1-L4 方法论 + GAARM 173 风险 + OWASP Top 10 (LLM/ASI/WSTG)。

    423 GitHub stars~2.7k tokensUpdated 3 mo ago
    SecurityAuto-check passed

  • Cyber Neo

    Hainrixz/cyber-neo

    Comprehensive cybersecurity analysis for any local project. An agent skill from Hainrixz/cyber-neo.

    281 GitHub stars~5.9k tokensUpdated 2 mo ago
    SecurityAuto-check: warnings

  • Semgrep Rule Creator

    skrun-dev/skrun

    Generate a complete Semgrep rule bundle (rule.yml + tests.md + README.md) from a CVE description and a bad-code example.

    210 GitHub stars~1.3k tokensUpdated 15 days ago
    SecurityAuto-check passed

More from transilienceai/communitytools

All 35 skills in this repo

  • Dfir

    transilienceai/communitytools

    Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline correlation.

    559 GitHub stars~1.5k tokensUpdated 2 mo ago
    Auto-check passed

  • GitHub Workflow

    transilienceai/communitytools

    GitHub workflow automation — branching, committing, pushing, pull requests, issues, and code review.

    559 GitHub stars~812 tokensUpdated 2 mo ago
    Auto-check: notes

  • Pci Secure Software

    transilienceai/communitytools

    Automated PCI Secure Software Standard (SSS) v2.0 readiness gap-assessment of an application from its source code and documentation.

    559 GitHub stars~1.8k tokensUpdated 2 mo ago
    Auto-check passed

  • Protect With Password

    transilienceai/communitytools

    Generate ONE strong password and apply it to each referenced file (PDF, Word, Excel, PowerPoint, or any type).

    559 GitHub stars~583 tokensUpdated 2 mo ago
    Auto-check passed

  • Skill Update

    transilienceai/communitytools

    Skill creation, update and management — generates skill directory structure, validates against best practices, enforces line count limits.

    559 GitHub stars~1.2k tokensUpdated 2 mo ago
    Auto-check passed

  • Transilience Report Style

    transilienceai/communitytools

    Generate a Transilience-branded PDF report (pentest, vuln assessment, compliance, threat intel) from a single findings JSON using the bundled ReportLab generator.

    559 GitHub stars~1.7k tokensUpdated 2 mo ago
    Auto-check passed

Categories

Questions about Source Code Scanning

What does Source Code Scanning do?

Security-focused source code review and SAST. An agent skill from transilienceai/communitytools. Source Code Scanning is an agent skill from transilienceai/communitytools. Security-focused source code review and SAST.

When should I use Source Code Scanning?

Source Code Scanning fits situations like: given source code; review code security; check dependencies for CVEs.

How do I install Source Code Scanning in Claude Code?

Run `npx skills add transilienceai/communitytools --skill source-code-scanning -a claude-code`. Or copy the skill folder (skills/source-code-scanning in transilienceai/communitytools) into .claude/skills/source-code-scanning in your project. Claude Code loads it when a task matches its description.

How do I install Source Code Scanning in Codex?

Run `npx skills add transilienceai/communitytools --skill source-code-scanning -a codex`. Or copy the skill folder (skills/source-code-scanning in transilienceai/communitytools) into .agents/skills/source-code-scanning in your project. Codex loads it when a task matches its description.

Can I use Source Code Scanning in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add transilienceai/communitytools --skill source-code-scanning -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/source-code-scanning, .gemini/skills/source-code-scanning, .github/skills/source-code-scanning and .opencode/skills/source-code-scanning in your project.

What does Source Code Scanning need to run?

Going by SKILL.md and its folder, Source Code Scanning needs the command-line tools its instructions call (gitleaks, semgrep, gh, npm, yarn and bundle). Our summary lists: Python 3.

Does Source Code Scanning access the network?

SKILL.md contains no URLs. Its commands use gh and npm, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Source Code Scanning safe to install?

Our automated static check of SKILL.md found notes only (mentions a .env file), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.

What licence does Source Code Scanning use?

Source Code Scanning is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Source Code Scanning use?

About 1.2k tokens (SKILL.md is roughly 4.6k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Source Code Scanning?

Skills that share tags, products or a category with Source Code Scanning: Golang Security (unxed/f4, 240 stars), Security Auditor (eigent-ai/eigent, 15k stars), Security Verification Gate (fengshao1227/ccg-workflow, 5.9k stars) and Secknowledge Skill (Pa55w0rd/secknowledge-skill, 423 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Source Code Scanning?

transilienceai (a GitHub organization) maintains it in transilienceai/communitytools, which has 559 GitHub stars. The repository holds 35 skills in this directory. The repository was last updated on July 29, 2026.

Source: transilienceai/communitytools on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.