Vulnerability Scanner

Reviewed 2026-10-23securityPrompt / Rule# security # owasp # vulnerability # supply-chain # audit

Community skill that teaches an agent to analyse a project for vulnerabilities (OWASP Top 10:2025, supply chain, attack surface, risk ranking) and ships a Python script that scans a folder.

Security Reviewed

Markdown guide plus a read-only Python scanner that runs npm audit in the target folder; no credentials, no direct network code.

Install Vulnerability Scanner in Google Antigravity

Antigravity loads skills from .agents/skills/ in your project or ~/.gemini/config/skills/ for all projects (official docs). Full guide

EasiestOption 1: paste this to your Antigravity agent

Install the "Vulnerability Scanner" skill for Google Antigravity.
Follow the steps at https://www.antigravityskills.org/install/vulnerability-scanner.md (source: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/vulnerability-scanner).
Before running anything, show me what you will download and whether it includes scripts, and wait for my OK.
Install it into this project (.agents/skills/) unless I say global. When done, check that Antigravity lists it as an installed skill.

The agent reads the install file, shows you what it will download and waits for your OK.

Option 2: install it yourself

1. Download the repository
```
git clone --depth 1 https://github.com/sickn33/antigravity-awesome-skills.git /tmp/ag-skills && git -C /tmp/ag-skills log -1 --format=%h
```
We reviewed commit dee7acc (the folder is identical to a307264). If the second command prints a different hash, the skill may have changed since our review.
2. Copy the skill into this project (workspace skill)
```
mkdir -p .agents/skills && cp -r /tmp/ag-skills/skills/vulnerability-scanner .agents/skills/
```
Run from your project root. Antigravity reads workspace skills from .agents/skills/<folder>/; this folder holds SKILL.md, checklists.md and scripts/security_scan.py (3 files).
3. Or install it for all projects (global skill)
```
mkdir -p ~/.gemini/config/skills && cp -r /tmp/ag-skills/skills/vulnerability-scanner ~/.gemini/config/skills/
```
Use this instead of the previous step. Copy only the skills you need: the repo README warns that a large watched skills folder can overload Antigravity's context.
4. Check that Antigravity sees it
Antigravity app: start a new conversation and ask "What skills do you have?"; vulnerability-scanner should be listed. Antigravity CLI: run /skills (/skills reload in a session that was already open).

The repository's own installer (npx agentic-awesome-skills --antigravity --skills <ids> --dry-run, README) can also install selected skills; the copy steps above use the standard Antigravity skill folders and install only this one.

Using Claude Code, Cursor or Codex? See other assistants below.

What is Vulnerability Scanner?

vulnerability-scanner is a community-contributed skill in sickn33's antigravity-awesome-skills collection. SKILL.md is a defensive review guide: assume-breach principles, the OWASP Top 10:2025 table, supply-chain questions, attack-surface mapping, a CVSS and EPSS prioritisation tree, a four-phase scan method and a finding template. It also bundles scripts/security_scan.py, which scans a project folder for secrets, risky code patterns, config problems and dependency issues, and checklists.md with audit checklists.

How to use Vulnerability Scanner?

Install the skill, then ask the agent to review a project you own. The agent follows the phases in SKILL.md (map the target, look for issues, validate and rank, report) and may run `python scripts/security_scan.py <project_path>` after you confirm. Findings come back with what, where, why, impact and fix.

Key features of Vulnerability Scanner

✓We counted at dee7acc (identical to a307264): the folder has 3 files, SKILL.md (286 lines, 8,090 bytes), checklists.md (121 lines) and scripts/security_scan.py (458 lines, 18,170 bytes)
✓We counted: checklists.md has 53 unchecked items under 5 headings (OWASP Top 10 audit, Authentication, API security, Data protection, Security headers) plus a short quick-audit table
✓We counted: the script has 12 secret regexes (AWS access keys, bearer tokens, private-key headers, JWTs, database URLs and more) and flags eval, exec, subprocess with shell=True and document.write as code-pattern risks
✓SKILL.md says OWASP Top 10:2025 added Software Supply Chain (A03) and Exceptional Conditions (A10) and folded SSRF into Broken Access Control (A01); we did not check this against OWASP's own page
✓Difference from a scanner product: it only reads files and calls npm audit; it does not test a running site or probe a network
✓The skill's own frontmatter marks it risk: critical, source: community

When to use Vulnerability Scanner

1Reviewing your own repository against the OWASP 2025 categories before a release
2Turning a scan into a ranked list using CVSS, exploit likelihood and asset value
3Getting audit checklists to paste into a PLAN.md or security report

Source and files

Repository: sickn33/antigravity-awesome-skills (MIT)
Upstream risk label: critical
Added upstream: 2026-02-27
SKILL.md size: 7.9 KB
Files in the skill folder: SKILL.md · checklists.md · scripts
Listing synced: 2026-10-05 from commit bdacd76

Installation & Setup Guide

Agent Rules / Prompt Setup

Follow these steps (taken from the project's own docs) to configure Vulnerability Scanner in your development environment.

Step 1: Claude Code (manual copy)claude

mkdir -p .claude/skills && cp -r /tmp/ag-skills/skills/vulnerability-scanner .claude/skills/

Not documented per skill by the repository; this uses Claude Code's standard .claude/skills/ folder after the clone above.

Step 2: Cursor: not documented by the projectcursor

The README lists installer targets for several hosts, but gives no per-skill Cursor path, so we do not list one.

Usage Example & Verification

Prompt / Request Example

1) SKILL.md usage: python scripts/security_scan.py <project_path>, optionally with --scan-type deps|secrets|patterns|config and --output summary (options we read in the script).

2) Our example: "Use the vulnerability-scanner skill to review this repo. Start with the attack surface, then run the bundled script in summary mode and rank the findings."
-> The agent lists entry points and trust boundaries first, runs the script (after asking you), then orders findings by severity and asset value.

3) Our example: "Give me the authentication and API checklists from this skill, filled in for our login service."
-> The agent copies the matching checklist sections and marks items it can confirm from the code.

Security Review

Static review

Reviewed Date

2026-10-23

Audited Ref / Commit

dee7acce0658c35cb276154892700811affcfdb2

Reviewer

antigravityskills.org (static code review)

Markdown guide plus a read-only Python scanner that runs npm audit in the target folder; no credentials, no direct network code.

Full review: scope, findings, risks

Audit Scope:skills/vulnerability-scanner/SKILL.md and checklists.md read in full; scripts/security_scan.py read for imports, subprocess use, file access, patterns and CLI options; repository README install and disclaimer sections and LICENSE, all at commit dee7acc (HEAD on 2026-10-23; the skill folder is identical to a307264 of 2026-10-14). Static review only; we did not run the script.

Key Findings:Instruction skill plus one Python script. The script imports subprocess and uses it once: npm audit --json in the target folder (timeout 60 s). It opens files for reading only (secrets, code patterns, configuration), makes no direct network calls, and has no eval/exec of scanned content. npm audit itself contacts the npm registry. No API keys needed.

Identified Operational Risks & Permissions:Medium. The script is read-only but the topic is offensive/defensive security; regex output can mislead; scanning code you do not own may be unauthorised.

The folder holds SKILL.md, checklists.md and scripts/security_scan.py. In the script we found one subprocess call, subprocess.run(["npm", "audit", "--json"], cwd=project_path, timeout=60), made only when package.json exists; file access is open(..., 'r') on files under the chosen path; there are no requests, urllib or socket imports, no os.system and no writes. The secret patterns (AWS keys, bearer tokens, private keys, JWTs, connection strings) are used for detection only. The skill text mentions eval and exec only as risky patterns to look for. We did not run the script, so this is a read of the code, not a behaviour test.

Operational Notes & Known Limitations

Known Limitations

•The script is pattern matching: regexes will miss real problems and flag harmless strings, so treat output as leads, not proof
•The npm audit step needs Node and npm, and npm audit contacts the npm registry
•Use only on code and systems you are authorised to review
•Frontmatter says risk: critical; a security-themed skill that runs a script deserves a read before you let an agent run it

Frequently Asked Questions

Is the Vulnerability Scanner skill safe?

SKILL.md and checklists.md are Markdown. The bundled script reads files under the folder you point it at, runs npm audit --json there with a 60-second timeout, and prints JSON or a summary; we found no network client or file writes in it. It is a security tool, so read it first and run it only on projects you own.

How do I install Vulnerability Scanner in Antigravity?

Clone sickn33/antigravity-awesome-skills, copy skills/vulnerability-scanner into .agents/skills/ (or ~/.gemini/config/skills/), then ask "What skills do you have?" (Antigravity CLI: /skills). The project README documents its own installer for selected skills.

Does it scan a live website?

No. It reviews files in a project folder and gives methodology for the agent; it does not send requests to a site.

Is it an official OWASP or Google skill?

No. It is community-contributed to an independent collection whose README says it is not affiliated with or endorsed by Google.

What does the bundled script write?

Nothing to disk that we could find: it prints results to the terminal as JSON or a summary.

Supported Platforms

antigravityclaude

View Source on GitHub

Keep exploring this topic

Browse the full Antigravity skills directory for more source-linked skills with install steps and static safety reviews.

More security skills #security #owasp #vulnerability #supply-chain Use cases

Related Skills

🛡️

Container Security (Snyk)

@snyk

Snyk's container-security skill: scan Docker images for OS and app vulnerabilities via the Snyk MCP server and fix Dockerfiles.

Static reviewinstructions onlyneeds API keynetwork accesswrites files

container-securitydocker

🛡️

Secrets Management

@sickn33

Community skill with a short procedure for handling CI/CD secrets safely: Vault, cloud secret managers, GitHub Actions, workload identity and rotation.

Static review

secretsci-cd

💻

Impeccable

@pbakaus

Paul Bakaus's Impeccable design skill: one /impeccable skill with 24 design commands, live browser iteration and a 59-rule detector for AI-generated frontend patterns.

Tested in AntigravityStatic reviewruns scriptsnetwork accesswrites files

frontenddesign