git:20260708.e42b71f to git:20260911.3a0a7c8

1 added, 1 removed. Audit A to A.

---

name: "security-scan"

description: "Run full security scan (native + external tools)"

---

# Security Scan

Run a full security scan using native checks plus any available external tools.

> **Semantic code review?** For code-logic vulnerabilities - SQL injection, XSS,

> broken authorization, insecure credential handling - use Claude Code's native

> **`/security-review`** (and its GitHub Action). This command is the

> *deterministic* complement: secret scanning (gitleaks + patterns) and

> dependency CVE audits (`pip-audit`, `npm audit`). Run both for full coverage.

## Arguments

- `--json` - Output as JSON (machine-readable)

- `--verbose` - Show matched patterns and additional details

- `--path <dir>` - Scan a specific directory (default: current project)

## What's Checked

### Native (always available)

- `.gitignore` coverage for sensitive file patterns

- File permissions on secrets/keys

- High-confidence secret patterns (AWS keys, GitHub tokens, API keys)

- `.env` files tracked by git

- Debug flags in production configs

### External (auto-detected)

- **gitleaks** - secret detection in working tree

- **pip-audit** - Python dependency CVEs

- **npm audit** - Node.js dependency CVEs

## Process

1. Run the security scanner on the current project

2. Display novice-friendly results with Why/Fix/Cmd for each finding

3. Exit code 0 if no critical issues, 1 if critical issues found

## Run Command

```bash

- PYTHONPATH="${HOME}/Projects/claude-power-pack/lib" python3 -m lib.security scan

+ PYTHONPATH="${HOME}/Projects/claude-power-pack" uv run --project "${HOME}/Projects/claude-power-pack" python -m lib.security scan

```