security-scan git:20260911.3a0a7c8A

Immutable. This exact content is served forever at /api/v1/blob/70f836e06beaef6a.

---
name: "security-scan"
description: "Run full security scan (native + external tools)"
---
<!-- GENERATED by claude-power-pack - scripts/codex-skill-sync.py; edit .claude/commands/security/scan.md instead -->

# Security Scan

Run a full security scan using native checks plus any available external tools.

> **Semantic code review?** For code-logic vulnerabilities - SQL injection, XSS,
> broken authorization, insecure credential handling - use Claude Code's native
> **`/security-review`** (and its GitHub Action). This command is the
> *deterministic* complement: secret scanning (gitleaks + patterns) and
> dependency CVE audits (`pip-audit`, `npm audit`). Run both for full coverage.

## Arguments

- `--json` - Output as JSON (machine-readable)
- `--verbose` - Show matched patterns and additional details
- `--path <dir>` - Scan a specific directory (default: current project)

## What's Checked

### Native (always available)
- `.gitignore` coverage for sensitive file patterns
- File permissions on secrets/keys
- High-confidence secret patterns (AWS keys, GitHub tokens, API keys)
- `.env` files tracked by git
- Debug flags in production configs

### External (auto-detected)
- **gitleaks** - secret detection in working tree
- **pip-audit** - Python dependency CVEs
- **npm audit** - Node.js dependency CVEs

## Process

1. Run the security scanner on the current project
2. Display novice-friendly results with Why/Fix/Cmd for each finding
3. Exit code 0 if no critical issues, 1 if critical issues found

## Run Command

```bash
PYTHONPATH="${HOME}/Projects/claude-power-pack" uv run --project "${HOME}/Projects/claude-power-pack" python -m lib.security scan
```