From glincker-claude-code-marketplace
Scans code for hardcoded secrets like API keys, SQL injection, XSS, insecure dependencies via npm/pip/cargo audits, and OWASP Top 10 issues using grep and bash.
npx claudepluginhub joshuarweaver/cascade-code-general-misc-4 --plugin glincker-claude-code-marketplaceThis skill is limited to using the following tools:
Comprehensive security analysis detecting hardcoded secrets, SQL injection, XSS, insecure dependencies, and OWASP Top 10 vulnerabilities.
Generates design tokens/docs from CSS/Tailwind/styled-components codebases, audits visual consistency across 10 dimensions, detects AI slop in UI.
Records polished WebM UI demo videos of web apps using Playwright with cursor overlay, natural pacing, and three-phase scripting. Activates for demo, walkthrough, screen recording, or tutorial requests.
Delivers idiomatic Kotlin patterns for null safety, immutability, sealed classes, coroutines, Flows, extensions, DSL builders, and Gradle DSL. Use when writing, reviewing, refactoring, or designing Kotlin code.
Comprehensive security analysis detecting hardcoded secrets, SQL injection, XSS, insecure dependencies, and OWASP Top 10 vulnerabilities.
Search for common secret patterns:
# API Keys
Grep for patterns:
- AWS: AKIA[0-9A-Z]{16}
- GitHub: ghp_[0-9a-zA-Z]{36}
- Slack: xox[baprs]-[0-9]{10,13}-[0-9a-zA-Z]{24,}
- Stripe: sk_live_[0-9a-zA-Z]{24}
- Private keys: -----BEGIN.*PRIVATE KEY-----
# Passwords
- password\s*=\s*["'][^"']+["']
- DB connection strings
- Hardcoded credentials
Example findings:
HIGH: Hardcoded AWS key found
File: src/config.js:12
Pattern: const AWS_KEY = "AKIAIOSFODNN7EXAMPLE"
Risk: Exposed AWS credentials
Fix: Use environment variables or secrets manager
SQL Injection:
# BAD: String concatenation
query = "SELECT * FROM users WHERE id = " + user_id
# GOOD: Parameterized query
query = "SELECT * FROM users WHERE id = ?"
Command Injection:
// BAD: Direct execution
exec(`ls ${userInput}`)
// GOOD: Sanitized input
execFile('ls', [sanitize(userInput)])
XSS Detection:
// BAD: innerHTML with user input
element.innerHTML = userInput
// GOOD: textContent or sanitize
element.textContent = userInput
// Or use DOMPurify
element.innerHTML = DOMPurify.sanitize(userInput)
# Check for vulnerable dependencies
npm audit
pip-audit
cargo audit
# Generate report
npm audit --json > audit-report.json
Broken Access Control
Cryptographic Failures
Injection
Insecure Design
Security Misconfiguration
# Security Scan Report
**Scan Date**: 2025-01-13
**Project**: myapp
**Total Issues**: 12
## Critical (2)
1. Hardcoded AWS credentials
- File: config/aws.js:5
- Risk: Full AWS account compromise
- Fix: Use AWS IAM roles or environment variables
2. SQL Injection vulnerability
- File: api/users.js:45
- Code: `SELECT * FROM users WHERE id = ${userId}`
- Fix: Use parameterized queries
## High (5)
3. XSS vulnerability in search
- File: components/Search.jsx:23
- Risk: Arbitrary JavaScript execution
- Fix: Sanitize user input with DOMPurify
4. Missing authentication on /admin endpoint
- File: routes/admin.js
- Risk: Unauthorized access to admin functions
- Fix: Add authentication middleware
## Medium (3)
5. Weak CORS configuration
- File: server.js:10
- Issue: CORS set to *
- Fix: Whitelist specific domains
## Low (2)
6. Console.log in production
- Multiple files
- Risk: Information disclosure
- Fix: Remove or use proper logging
## Recommendations
1. Implement secrets management (AWS Secrets Manager, Vault)
2. Add input validation library (joi, express-validator)
3. Enable Content Security Policy
4. Implement rate limiting
5. Add security headers (helmet.js)
// Before (Vulnerable)
const query = `SELECT * FROM users WHERE email = '${email}'`;
// After (Fixed)
const query = 'SELECT * FROM users WHERE email = ?';
db.execute(query, [email]);
User: "Scan my code for security issues"
Output:
User: "Check for vulnerable dependencies"
Output:
npm audit fixGLINCKER Team