What is security-scan?

A security scan of source code and its dependencies, which are external packages the project uses. It produces a report with findings ranked by severity.

Use it to scan dependencies, configuration, source-code patterns, and secrets, then review the resulting security findings.

It helps locate known package risks, exposed credentials, and suspicious code patterns before they reach users or production.

security-scan — Command for Claude Code by fatihkan

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo

git clone --depth 1 https://github.com/fatihkan/badi

Made for: Claude Code.

Or install badi, the plugin that ships this one along with the rest of its 81 skills, 86 commands, 30 agents, 7 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/commands/fatihkan/badi/security-scan.svg)](https://agentmods.dev/commands/fatihkan/badi/security-scan)

Your own site

<a href="https://agentmods.dev/commands/fatihkan/badi/security-scan"><img src="https://agentmods.dev/badge/commands/fatihkan/badi/security-scan.svg" alt="Measured on agentmods" height="20"></a>

Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 1,233 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00000	$0.01233
Opus 5	$0.00000	$0.00616
Sonnet 5	$0.00000	$0.00247
Haiku 4.5	$0.00000	$0.00123

Measured today against content hash 47f4f2ae3fb5, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-06, from the pricing page.

Security

Grade A, and why

security-scan scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Runs shell commandslowCapability

Expected in a hook, worth knowing in a rule or an instructions file.

- Command injection: `exec()`, `eval()`, `child_process` usage

.claude/commands/security-scan.md · 142 lines

How it starts

The opening of the file, as written. The whole thing — 142 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Security scan. Searches the codebase and dependencies for vulnerabilities and produces a severity-ranked report.

Native command (v1.31.0+): With Claude Code 2.1.140+, /security-review is now a native command (built-in slash). This command complements it with a deterministic baseline (badi security baseline) + post-scan triage (badi security triage).

Recommended flow:

badi security baseline — secrets + dependencies (deterministic)

/security-review — AI semantic vulnerability hunt (Anthropic native)

badi security triage — report severity filtering

CI: badi security init --ci — automatic review on PRs

Badi CLI Commands (v1.6+)

This command first invokes these CLI tools:

badi secret-scan — 17-pattern secret/credential scan (AWS, GCP, GitHub, OpenAI, Stripe, DB URIs, private keys)
badi secret-scan --git — Also scan the last 100 commits
badi a11y [url] — Accessibility (part of the security audit) Then it delegates to the security-scanner agent (code pattern analysis).

Required Tools

Bash (npm audit, dependency scan)
Read (configuration files)
Grep (code pattern scan)
...

Agent Delegation

This command delegates the main scan to the security-scanner agent. If the agent is unavailable, apply the steps below directly.

Section 1: Dependency Vulnerability Scan

Step 1: Package Manager Detection and Audit

npm: run npm audit --json
yarn: run yarn audit --json
pip: run pip audit or safety check
...

Step 2: Vulnerability Classification

Record per finding:

Package name and version
CVE number (if any)
Severity: CRITICAL / HIGH / MEDIUM / LOW
...

Step 3: Dependency Chain Analysis

Determine direct vs. transitive dependency
For transitive ones, show which parent package pulls it in
Verify the lock file is current

Section 2: Code Pattern Analysis

Step 4: Hardcoded Secret Scan

Run badi secret-scan first — a fast scan with 17 patterns:

AWS Access/Secret, GCP, GitHub PAT (classic + fine-grained), Slack, Stripe, OpenAI, Anthropic
npm, SendGrid, Twilio, MongoDB/Postgres URIs
RSA/EC private keys, JWT tokens
Generic secrets (20-64 chars)

Read the full file on GitHub · 142 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

today First seen · 142 lines · 0 tokens per session scan A 47f4f2ae3fb5

Subscribe to this mod's changes

security-scan is a command published in the GitHub repository fatihkan/badi (7 stars, last pushed yesterday), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,233 tokens. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-06.

Security agents ai-workflow cli developer-tools hooks

security-scan