# agentic-security-scanner

A skill that scans your code for vulnerabilities, explains findings in plain English and fixes them. Useful when AI writes code faster than you can review it.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 462 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/agentic-security-scanner/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/agentic-security-scanner

## What it does

The scan covers static analysis, dependencies, hardcoded secrets, infrastructure config, LLM safety and an audit of the agent's MCP tools. Findings come with a cost estimate and a concrete fix instead of CVE jargon. Modes include diff-only, watch and a deep pass over old code.

Fixes run with a preview, a backup and a revert option. One mode opens a pull request, another moves leaked secrets into a vault. Creating a PR needs `GITHUB_TOKEN`; Slack alerts need `SLACK_WEBHOOK_URL`. Settings live in `.agentic-security/config.json`.

Bodyguard mode installs as a git hook and catches unsafe AI output before it reaches disk: SQL string concatenation, embedded API keys, `eval()` on user input, weak crypto. The hook blocks the commit, so on a legacy codebase set a baseline first — otherwise the stream of findings will stall your work.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill agentic-security-scanner -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/agentic-security-scanner/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/agentic-security-scanner/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill agentic-security-scanner -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/agentic-security-scanner/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill agentic-security-scanner -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/agentic-security-scanner/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills agentic-security-scanner
```

2. **Manually: put the files in place**
- File: `.github/skills/agentic-security-scanner/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill agentic-security-scanner -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/agentic-security-scanner
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/agentic-security-scanner/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill agentic-security-scanner -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/agentic-security-scanner/SKILL.md

## When to use it
- catch SQL injection and hardcoded keys before release
- check dependencies for known CVEs and generate an SBOM
- remediate critical findings in one command with a rollback
- map the project against NIST AI 600-1 or OWASP ASVS
- block unsafe AI-generated code before it gets committed

## Example prompts
- Scan this project for vulnerabilities and show only critical findings
- Fix all critical issues and open a pull request with the changes
- Install git hooks so unsafe code is blocked before commit

## Similar
- [agentic-security](https://affpapa.org/en/nevibecode/plugins/agentic-security.md) — plugin · ★ 120
- [security-review](https://affpapa.org/en/nevibecode/skills/security-review.md) — skill · 5500 installs
- [ghost-scan-code](https://affpapa.org/en/nevibecode/skills/ghost-scan-code.md) — skill · 5200 installs
- [agent-bom](https://affpapa.org/en/nevibecode/mcp/agent-bom.md) — MCP server · ★ 35
- [find-security-vulnerabilities-in-code](https://affpapa.org/en/nevibecode/skills/find-security-vulnerabilities-in-code.md) — skill · 12500 installs
- [credential-scanner](https://affpapa.org/en/nevibecode/skills/credential-scanner.md) — skill · 538 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 69 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md