Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →transilienceai/source-code-scanning
Security-focused source code review and SAST. Scans for vulnerabilities (OWASP Top 10, CWE Top 25), CVEs in third-party dependencies/packages, hardcoded secrets, malicious code, and insecure patterns.
Passed 17 of 23 test cases with the skill, and 13 of 23 without it.
and 2 more in the full report
4 fixed13 passed either way6 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
An auditor is examining suspicious obfuscated scripts found inside a third-party dependency. What critical rule must be strictly followed regarding code execution during the review?
| Checked | Without skill | With skill |
|---|---|---|
| States that untrusted code must never be executed during review. | Missed | Passed |
The instructions your model reads when the skill loads.
- Languages: ls **/*.{py,js,ts,java,go,rb,php,cs,rs}
- Packages: find package.json, requirements.txt, go.mod, pom.xml, Gemfile, composer.json, Cargo.toml
- Entry points: main(), index.*, app.*, server.*
- Config files: .env*, config.*, settings.*, *.yaml, *.toml
See sast-tools.md for commands per language.
Key tools:
semgrep --config=auto .)bandit -r . -f json)gosec ./...)brakeman -o report.json)gh codeql)See dependency-cve-scanning.md for commands.
| Ecosystem | Command |
|---|
test cases passed, vs 13 / 23 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.