vuln-scanner

Plugin vuln-scanner from marketplace basic-vulnerability-scanner in JuanDuran85/basic-vulnerability-scanner. Commands read from the repo's manifest — 1 month ago.

Skills (8)

• vuln-scanner-access-secrets

  Audit application-layer RBAC/access control, hardcoded secrets vs. secrets-manager usage, and collect evidence requests for cloud console MFA and PII resource tagging. Writes plans to .plans/access-secrets/. Read-only. Invoke manually with /vuln-scanner-access-secrets; not triggered automatically.

• vuln-scanner-appsec

  Audit application-security defects that let an attacker reach data in the first place — input validation and mass assignment, injection, SSRF, path traversal and uploads, JWT/session handling, object-level authorization (IDOR), security headers, rate limiting, supply chain, and secrets in git histor

• vuln-scanner-assurance

  Audit CORS configuration, outdated dependencies/CVE exposure, and collect evidence of penetration testing / ethical hacking. Writes plans to .plans/assurance/. Read-only. Invoke manually with /vuln-scanner-assurance; not triggered automatically.

• vuln-scanner-data-protection

  Audit encryption at rest (AES-256), encryption in transit (TLS 1.2+), PII data masking in APIs/persistence, and retention/TTL policy for the current repository. Writes Markdown plans to .plans/data-protection/. Read-only. Invoke manually with /vuln-scanner-data-protection; not triggered automaticall

• vuln-scanner-discover

  Build a technical and documentation inventory of the current repository (stack, persistence, messaging, logging/telemetry, external services, CI/CD) and write it to .plans/discover/. Read-only, no compliance judgment. Invoke manually with /vuln-scanner-discover; not triggered automatically.

• vuln-scanner-observability

  Audit console.*/logger.* calls for PII and secret exposure, classify by risk, and check audit-log completeness (IP/user/timestamp). Handles high-volume logging findings (tens to hundreds of matches) by aggregating and sampling instead of enumerating. Writes plans to .plans/observability/. Read-only.

• vuln-scanner-privacy-governance

  Detect evidence of consent management integration, determine whether real cross-border data transfers exist and reference applicable Chilean law if so, and check for ARCO-style data subject rights implementation. Evidence detection only — never drafts consent flows, DPAs, or legal clauses. Writes pl

• vuln-scanner-report

  Consolidate the audit plans already written under .plans/ into a single .plans/00-summary.md — controls ranked by severity across packs, top risks, evidence requests grouped by who can answer them, and which packs have not been run yet. Runs no audit and reads no source code. Invoke manually with /v

Similar plugins