Vulnerability Check
SkillSecurityvuln-check lets your AI scan a project for dependencies with known vulnerabilities and common security flaws. Once added, it finds risky packages and unsafe patterns, then reports what to fix, ordered by severity so the most serious issues come first.
Available today. Use it from your connected AI after setup.
No other account needed.
After adding vuln-check, ask your AI to check your project for security vulnerabilities, or run the /vuln-check command to start a scan.
Then ask your AI: use the Vulnerability Check skill
What your AI can do with it
- Scan a project for dependencies with known vulnerabilities
- Detect common security anti-patterns in the code
- Report issues ranked by severity
- Suggest fixes for the problems it finds
- Run a check whenever you ask for a vulnerability review or use the /vuln-check command
What this skill tells your AI
The instructions your AI receives, as published by ccch1mneyyy/dsh-tui in .agents/skills/vuln-check/SKILL.md and read by ahel’s review.
Check the current project for security vulnerabilities: dependency advisories and code-level security anti-patterns.
Procedure
- 依赖审计: inspect the lockfile/manifest (package-lock.json / pnpm-lock.yaml / requirements.txt…) for known-vulnerable versions. Use the local toolchain (npm audit / pnpm audit when available and network permits) or compare against known advisory data.
- 代码检查: scan for security anti-patterns with file/line evidence:
- shell command injection (string interpolation into exec/spawn with shell:true)
- path traversal (user input joined into paths without normalization)
- secrets committed (API keys, tokens, private keys in the tree); report only the file path, line, and secret type, never the value or source excerpt
- unsafe eval / dynamic import of user input
- missing input validation at trust boundaries
- Report findings ordered by severity, each with: location, CVE/advisory id when applicable, impact, and remediation (upgrade to which version, or the code change needed).
- State explicitly when the project is clean in a category.
Constraints
- Never disclose a complete secret; diagnostics may report only whether it is set.
- Distinguish "verified vulnerable" from "needs verification" — never overstate.
- Do not modify code during the check.
Signals
- GitHub stars
- 3k
- Forks
- 176
- Last commit
- Sep 2026
Advanced
- Catalog kind
- skill
- Gateway key
vuln-check- Source
- github.com/ccch1mneyyy/dsh-tui