Security Vulnerability Scanner Guide

Complete Security Analysis Framework

This guide demonstrates the Security Vulnerability Scanner skill for identifying, prioritizing, and remediating security vulnerabilities in Python applications.

1. Vulnerability Detector

Overview

The VulnDetector identifies common security vulnerabilities using pattern matching and static analysis.

Example: SQL Injection Detection

from scripts.vuln_detector import VulnDetector

detector = VulnDetector()

vulnerable_code = """
def get_user(user_id):
    query = "SELECT * FROM users WHERE id = " + user_id
    return db.execute(query)
"""

vulns = detector.detect_sql_injection(vulnerable_code)
print(f"Found {len(vulns)} SQL injection vulnerabilities")
for vuln in vulns:
    print(f"Type: {vuln['type']}, Severity: {vuln['severity']}")

Example: Command Injection Detection

vulnerable_code = """
import os
def process_file(filename):
    os.system(f"process {filename}")
"""

vulns = detector.detect_command_injection(vulnerable_code)
print(f"Vulnerabilities: {vulns}")

Example: Path Traversal Detection

vulnerable_code = """
def download_file(filename):
    path = f"/uploads/{filename}"
    with open(path) as f:
        return f.read()
"""

vulns = detector.detect_path_traversal(vulnerable_code)
print(f"Path traversal risks: {vulns}")

Example: XSS Detection

vulnerable_template = """
<h1>{{ user_input }}</h1>
<script>alert('{{ user_message }}')</script>
"""

vulns = detector.detect_xss_vulnerabilities(vulnerable_template)
print(f"XSS vulnerabilities found: {len(vulns)}")

Example: Hardcoded Secrets Detection

vulnerable_code = """
API_KEY = "sk_live_abcd1234efgh5678ijkl9999"
password = "MySecretPassword123"
token = "ghp_myGitHubToken123456789"
"""

vulns = detector.detect_hardcoded_secrets(vulnerable_code)
for vuln in vulns:
    print(f"Secret Found: {vuln['description']}")

Example: Insecure Deserialization Detection

vulnerable_code = """
import pickle
def load_data(data):
    return pickle.loads(data)
"""

vulns = detector.detect_insecure_deserialization(vulnerable_code)
print(f"Deserialization risks: {vulns}")

Example: Comprehensive Scan

full_codebase = """
import os
import pickle

def get_user(user_id):
    query = "SELECT * FROM users WHERE id = " + user_id
    return db.execute(query)

def process(file):
    os.system(f"process {file}")

API_KEY = "sk_live_secret"
data = pickle.loads(request.data)
"""

all_vulns = detector.detect_all_vulnerabilities(full_codebase)
for vuln in all_vulns:
    print(f"{vuln['type'].upper()}: {vuln['severity']} - {vuln['description']}")

2. Risk Scorer

Overview

The RiskScorer calculates CVSS-based vulnerability scores and prioritizes remediation.

Example: Individual Vulnerability Scoring

from scripts.risk_scorer import RiskScorer

scorer = RiskScorer()

vulnerability = {
    "type": "sql_injection",
    "severity": "CRITICAL",
    "description": "SQL injection in login form",
    "cwe_id": "CWE-89"
}

score = scorer.score_vulnerability(vulnerability)
print(f"CVSS Score: {score['cvss_score']}/10")
print(f"Exploitability: {score['exploitability']}/10")
print(f"Impact: {score['impact']}/10")
print(f"Priority: {score['priority']}")

Example: Batch Vulnerability Scoring

vulnerabilities = [
    {
        "type": "sql_injection",
        "severity": "CRITICAL",
        "description": "SQL injection",
        "cwe_id": "CWE-89"
    },
    {
        "type": "missing_authentication",
        "severity": "HIGH",
        "description": "Missing auth check",
        "cwe_id": "CWE-306"
    },
    {
        "type": "path_traversal",
        "severity": "MEDIUM",
        "description": "Directory traversal",
        "cwe_id": "CWE-22"
    }
]

scored = scorer.score_vulnerabilities(vulnerabilities)
for vuln in scored:
    print(f"{vuln['type']}: CVSS {vuln['cvss_score']} - Priority: {vuln['priority']}")

Example: Risk Profile Analysis

risk_profile = scorer.calculate_risk_profile(vulnerabilities)

print(f"Overall Risk: {risk_profile['overall_risk']}")
print(f"Total Vulnerabilities: {risk_profile['total_vulnerabilities']}")
print(f"Critical: {risk_profile['critical_count']}")
print(f"High: {risk_profile['high_count']}")
print(f"Average CVSS: {risk_profile['average_cvss']}")
print(f"Max CVSS: {risk_profile['max_cvss']}")

for rec in risk_profile['recommendations']:
    print(f"  - {rec}")

Example: Remediation Prioritization

prioritized = scorer.prioritize_remediation(vulnerabilities)

for item in prioritized:
    print(f"#{item['rank']}: {item['type']}")
    print(f"  CVSS: {item['cvss_score']}, Effort: {item['estimated_effort_hours']}h")
    print(f"  ROI: {item['effort_vs_impact_ratio']}")

Example: Business Impact Assessment

impact = scorer.estimate_business_impact(vulnerabilities)

print(f"Estimated Financial Impact: {impact['estimated_financial_impact']}")
print(f"Risk Level: {impact['risk_level']}")
print(f"Recommendation: {impact['business_recommendation']}")
print(f"Compliance Risk: {impact['compliance_risk']}")

3. Remediation Suggester

Overview

The RemediationSuggester provides code-level guidance for fixing vulnerabilities.

Example: Single Vulnerability Remediation

from scripts.remediation_suggester import RemediationSuggester

suggester = RemediationSuggester()

vulnerability = {
    "type": "sql_injection",
    "description": "SQL injection in login"
}

remediation = suggester.suggest_remediation(vulnerability)
print(f"Vulnerability: {remediation['vulnerability_type']}")
print(f"Priority: {remediation['priority']}")
print(f"Effort: {remediation['estimated_effort_hours']} hours")

for approach in remediation['fix_approaches']:
    print(f"  - {approach}")

print(f"\nCode Example:")
example = remediation['code_example']
print(f"Vulnerable:\n{example['vulnerable_code']}")
print(f"\nSecure:\n{example['secure_code']}")

Example: Remediation Plan

plan = suggester.generate_remediation_plan(vulnerabilities)

print(f"Total Effort: {plan['summary']['total_estimated_weeks']} weeks")
print(f"\nImmediate ({plan['phases']['immediate']['deadline']}):")
for item in plan['phases']['immediate']['items']:
    print(f"  - {item['vulnerability_type']}")

print(f"\nShort Term ({plan['phases']['short_term']['deadline']}):")
for item in plan['phases']['short_term']['items']:
    print(f"  - {item['vulnerability_type']}")

Example: Secure Code Examples

# Get before/after examples for each vulnerability type
for vuln in vulnerabilities:
    examples = suggester.generate_secure_code_examples(vuln)
    print(f"\n{vuln['type'].upper()}")
    print(f"Explanation: {examples['explanation']}")
    print(f"\nVulnerable Code:")
    print(examples['vulnerable_code'])
    print(f"\nSecure Code:")
    print(examples['secure_code'])

Example: Security Tools Recommendation

tools = suggester.get_security_tools_recommendation(vulnerabilities)

print("Recommended Security Tools:")
for tool in tools:
    print(f"\n{tool['name']}")
    print(f"  Examples: {', '.join(tool['examples'])}")
    print(f"  Cost: {tool['estimated_cost']}")

4. CVE Checker

Overview

The CVEChecker identifies known vulnerabilities in dependencies.

Example: Single Package Check

from scripts.cve_checker import CVEChecker

checker = CVEChecker()

cves = checker.check_package("flask", "1.1.0")
if cves:
    print(f"Found {len(cves)} CVEs:")
    for cve in cves:
        print(f"  {cve['cve_id']}: {cve['severity']}")
        print(f"    Fixed in: {cve['fixed_version']}")

Example: Requirements File Check

requirements = {
    "requests": "2.25.0",
    "django": "2.2.0",
    "flask": "1.1.0",
    "pyyaml": "5.3.0"
}

result = checker.check_requirements_file(requirements)

summary = result['summary']
print(f"Total Packages: {summary['total_packages']}")
print(f"Vulnerable: {summary['vulnerable_packages']}")
print(f"CVEs Found: {summary['vulnerabilities_found']}")
print(f"  Critical: {summary['critical_count']}")
print(f"  High: {summary['high_count']}")

print("\nUpgrade Recommendations:")
for rec in result['recommendations']:
    print(f"  - {rec}")

Example: Package Vulnerability History

history = checker.check_package_vulnerability_history("django")

print(f"Package: {history['package']}")
print(f"Total CVEs: {history['total_cves']}")
print(f"Risk Level: {history['risk_level']}")
print(f"Recommendation: {history['recommendation']}")

print("\nVulnerability Timeline:")
for vuln in history['vulnerabilities'][:5]:  # Top 5
    print(f"  {vuln['publication_date']}: {vuln['cve_id']}")

Example: SBOM Generation

sbom = checker.generate_sbom(requirements)

print(f"SBOM Components: {sbom['metadata']['total_components']}")
print(f"Total CVEs: {sbom['metadata']['total_cves']}")

print("\nComponent Summary:")
for component in sbom['components']:
    status = f" ({component['vulnerabilities']} CVEs)" if component['vulnerabilities'] > 0 else " (OK)"
    print(f"  {component['package']}: {component['version']}{status}")

Example: License Compliance Check

licenses = checker.check_dependency_licenses(requirements)

print("License Summary:")
for license_type, packages in licenses['licenses_found'].items():
    print(f"  {license_type}: {', '.join(packages)}")

if licenses['restricted_licenses']:
    print("\nRestricted Licenses:")
    for restricted in licenses['restricted_licenses']:
        print(f"  {restricted['package']}: {restricted['license']}")
        print(f"    Reason: {restricted['reason']}")

Example: Vulnerability Report

report = checker.generate_vulnerability_report(requirements)
print(report)

Integration Examples

Complete Security Audit Workflow

from scripts.vuln_detector import VulnDetector
from scripts.risk_scorer import RiskScorer
from scripts.remediation_suggester import RemediationSuggester
from scripts.cve_checker import CVEChecker

# 1. Scan code for vulnerabilities
detector = VulnDetector()
code_vulns = detector.detect_all_vulnerabilities(source_code)

# 2. Score and prioritize
scorer = RiskScorer()
risk_profile = scorer.calculate_risk_profile(code_vulns)

# 3. Get remediation guidance
suggester = RemediationSuggester()
plan = suggester.generate_remediation_plan(code_vulns)

# 4. Check dependencies
checker = CVEChecker()
dep_vulns = checker.check_requirements_file(requirements)

# 5. Generate comprehensive report
report = f"""
# Security Audit Report

## Code Vulnerabilities
- Total: {len(code_vulns)}
- Critical: {risk_profile['critical_count']}
- Overall Risk: {risk_profile['overall_risk']}

## Dependency Status
- Vulnerable Packages: {dep_vulns['summary']['vulnerable_packages']}
- Total CVEs: {dep_vulns['summary']['vulnerabilities_found']}

## Remediation Plan
- Estimated Effort: {plan['summary']['total_estimated_weeks']} weeks
- Immediate Actions: {plan['phases']['immediate']['count']}

## Next Steps
{chr(10).join([f"1. {step}" for step in risk_profile['recommendations'][:3]])}
"""
print(report)

Security Best Practices

1. Vulnerability Detection

Regular scanning - Automate security checks in CI/CD
Context matters - False positives may occur; review findings
Patterns evolve - Update detection rules regularly

2. Risk Assessment

Use CVSS - Standardized scoring helps prioritization
Consider context - Internet-facing systems need higher standards
Track metrics - Monitor vulnerability trends over time

3. Remediation

Fix critical first - Address high-impact issues before deployment
Test thoroughly - Ensure fixes don't break functionality
Document changes - Track security improvements for audits

4. Dependency Management

Automate updates - Use dependabot or similar tools
Monitor CVEs - Subscribe to security bulletins
Assess alternatives - Consider replacing unmaintained packages

Compliance & Standards

OWASP Top 10: All major categories covered
CWE/CVSS: Industry-standard scoring and categorization
SBOM: Software Bill of Materials for supply chain security
License Compliance: Identify license restrictions

Troubleshooting

Issue	Solution
Too many false positives	Tune detection rules, add whitelisting
Remediation too complex	Break into smaller steps, prioritize carefully
CVE database outdated	Update regularly from official sources
License conflicts	Review and choose compatible alternatives

Summary

The Security Vulnerability Scanner provides complete visibility into application security:

Detector: Identify vulnerabilities in code
Scorer: Quantify and prioritize risks
Suggester: Get actionable remediation guidance
CVE Checker: Track dependency vulnerabilities

Use these tools to systematically improve application security posture.

Install Command

Content

Skill.md

Security Vulnerability Scanner Guide

Complete Security Analysis Framework

1. Vulnerability Detector

Overview

Example: SQL Injection Detection

Example: Command Injection Detection

Example: Path Traversal Detection

Example: XSS Detection

Example: Hardcoded Secrets Detection

Example: Insecure Deserialization Detection

Example: Comprehensive Scan

2. Risk Scorer

Overview

Example: Individual Vulnerability Scoring

Example: Batch Vulnerability Scoring

Example: Risk Profile Analysis

Example: Remediation Prioritization

Example: Business Impact Assessment

3. Remediation Suggester

Overview

Example: Single Vulnerability Remediation

Example: Remediation Plan

Example: Secure Code Examples

Example: Security Tools Recommendation

4. CVE Checker

Overview

Example: Single Package Check

Example: Requirements File Check

Example: Package Vulnerability History

Example: SBOM Generation

Example: License Compliance Check

Example: Vulnerability Report

Integration Examples

Complete Security Audit Workflow

Security Best Practices

1. Vulnerability Detection

2. Risk Assessment

3. Remediation

4. Dependency Management

Compliance & Standards

Troubleshooting

Summary