# Source Code Scanning

> Security-focused source code review and SAST. Scans for vulnerabilities (OWASP Top 10, CWE Top 25), CVEs in third-party dependencies/packages, hardcoded secrets, malicious code, and insecure patterns. Use when given source code, a repo path, or asked to "audit", "scan", "review" code security, or "check dependencies for CVEs".

- **Type:** Skill
- **Install:** `agentstack add skill-transilienceai-communitytools-source-code-scanning`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [transilienceai](https://agentstack.voostack.com/s/transilienceai)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [transilienceai](https://github.com/transilienceai)
- **Source:** https://github.com/transilienceai/communitytools/tree/main/skills/source-code-scanning
- **Website:** https://www.transilience.ai/

## Install

```sh
agentstack add skill-transilienceai-communitytools-source-code-scanning
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Source Code Security Review

## Quick Start

1. **Identify** - languages, frameworks, package managers present
2. **Automated SAST** - run tools appropriate to the stack
3. **Dependency CVEs** - scan lockfiles/manifests for known CVEs
4. **Secrets scan** - detect hardcoded credentials/tokens
5. **Manual review** - trace high-risk sinks (exec, eval, query, deserialize)
6. **Malicious code** - check for backdoors, obfuscation, suspicious network calls
7. **Report** - findings with CWE/CVE refs, severity, PoC, remediation

## Workflow

### Phase 1: Enumerate
```
- Languages: ls **/*.{py,js,ts,java,go,rb,php,cs,rs}
- Packages: find package.json, requirements.txt, go.mod, pom.xml, Gemfile, composer.json, Cargo.toml
- Entry points: main(), index.*, app.*, server.*
- Config files: .env*, config.*, settings.*, *.yaml, *.toml
```

### Phase 2: Automated SAST
See [sast-tools.md](reference/sast-tools.md) for commands per language.

Key tools:
- **Multi-language**: Semgrep (`semgrep --config=auto .`)
- **Python**: Bandit (`bandit -r . -f json`)
- **JavaScript/TS**: ESLint security plugin, njsscan
- **Java**: SpotBugs + FindSecBugs
- **Go**: gosec (`gosec ./...`)
- **PHP**: PHPCS Security Audit
- **Ruby**: Brakeman (`brakeman -o report.json`)
- **All**: CodeQL (via `gh codeql`)

### Phase 3: Dependency CVE Scan
See [dependency-cve-scanning.md](reference/dependency-cve-scanning.md) for commands.

| Ecosystem | Command |
|---|---|
| npm/yarn | `npm audit --json` / `yarn audit` |
| Python | `pip-audit -r requirements.txt` |
| Java | `dependency-check --scan .` |
| Go | `govulncheck ./...` |
| Ruby | `bundle audit` |
| Generic | `trivy fs .` / `grype dir:.` |

### Phase 4: Secrets Detection
See [secrets-detection.md](reference/secrets-detection.md).
```bash
trufflehog filesystem . --json
gitleaks detect --source . -v
```

### Phase 5: Manual Review
Focus on high-risk sinks — see [manual-review.md](reference/manual-review.md):
- Injection sinks: `exec`, `eval`, `query`, `system`, `popen`
- Deserialization: `pickle.loads`, `ObjectInputStream`, `unserialize`
- Crypto: hardcoded keys, weak algorithms (MD5, SHA1, DES, ECB)
- Auth: JWT validation, session management, RBAC enforcement
- File ops: path construction with user input

### Phase 6: Malicious Code
See [malicious-code.md](reference/malicious-code.md):
- Obfuscated strings (base64, hex, charCode)
- Unexpected network calls in library code
- Typosquatting indicators
- Postinstall/lifecycle script abuse
- Hidden backdoors in dependencies

## Language-Specific Patterns
See [language-patterns.md](reference/language-patterns.md) for Python, JS, Java, Go, PHP, Ruby.

## Severity Mapping

| Severity | CVSS | Examples |
|---|---|---|
| Critical | 9.0+ | RCE, SQLi with exfil, auth bypass |
| High | 7.0-8.9 | Stored XSS, SSRF, insecure deserialization |
| Medium | 4.0-6.9 | Reflected XSS, info disclosure, IDOR |
| Low | 0.1-3.9 | Missing headers, verbose errors |

## Output Format

```
findings/
  --.md   # One file per finding
evidence/
  -output.json                      # Raw tool output
summary-report.md                         # Executive summary
```

Each finding: CWE/CVE ID | File:Line | Severity | PoC | Remediation

## Mobile App Analysis (APK/IPA)

When given a mobile app binary:
1. **Extract**: `unzip app.apk -d extracted/` (APKs are ZIP archives)
2. **Identify framework**: React Native (`assets/index.android.bundle`), Flutter (`libflutter.so`), Xamarin, or native
3. **React Native**: JS bundle is plaintext — search for secrets, API keys, config objects, hardcoded tokens
4. **Encoded secrets**: Search for base64 prefixes of known flag/secret formats (e.g., `RkxBR` = base64 of `FLAG`). Config objects often store secrets as base64 in `debug`, `secret`, `apiKey` fields
5. **Native**: Use `jadx` for Java/Kotlin decompilation, check `AndroidManifest.xml`, `strings.xml`, `BuildConfig`
6. **Shared libs**: Check `.so` files with `strings` for hardcoded credentials

## Critical Rules
- Never execute untrusted code during review
- Treat all findings as potential until verified
- Always cross-reference CVEs against actual version in use
- Report supply chain issues separately (they affect all users)

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [transilienceai](https://github.com/transilienceai)
- **Source:** [transilienceai/communitytools](https://github.com/transilienceai/communitytools)
- **License:** MIT
- **Homepage:** https://www.transilience.ai/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** yes
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-transilienceai-communitytools-source-code-scanning
- Seller: https://agentstack.voostack.com/s/transilienceai
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.