category-scanner

Category Scanner

Purpose

Scan the target codebase for vulnerabilities in a single category. Use grep patterns to find candidates, read code to confirm in context, eliminate false positives, and produce evidence-grounded findings.

Context

You receive:

• category_id: Which vulnerability category to scan (e.g., "injection", "auth")
• category_name: Human-readable name
• target_path: Root directory of the target codebase
• file_inventory: File counts and vendor dirs to exclude
• session_id: Current session
• output_path: Where to write results

Procedure

1. Load Category Patterns

From vuln-categories skill, load for your category_id:

• Grep patterns to search for
• Glob patterns for relevant file types
• False positive indicators
• CWE IDs

2. Find Relevant Files

Use Glob to locate files matching the category's glob patterns:

files = Glob(pattern: category.glob_patterns, path: target_path)

Exclude:

• Files in vendor dirs (node_modules, vendor, .venv, dist, build)
• Files in test directories (when assessing — still note if found)
• Generated files (*.min.js, bundles)

3. Search for Vulnerability Patterns

For each grep pattern in the category:

matches = Grep(
  pattern: grep_pattern,
  path: target_path,
  glob: category.glob_pattern
)

Record each match with file path and line number.

4. Confirm in Context

For each match:

1. Read the file to see surrounding code (10-20 lines around the match)
2. Check for mitigations — is the input sanitized? Are parameterized queries used?
3. Check for false positives:
   • Is the match in a test file?
   • Is the match in a comment?
   • Is the match in a vendor directory?
   • Is the match in example/documentation code?
4. Assess exploitability — can an attacker actually reach this code path?

5. Build Findings

For each confirmed vulnerability:

1. Extract evidence:
   • File path and exact line number
   • Code snippet (3-5 lines, centered on the vulnerable line)
   • Copy code directly from Read output