---
name: security-scanner
description: "Instructions for the upstream workflow: Scan Python skills and MCP servers for malicious code — dangerous imports, network exfiltration, filesystem abuse, subprocess injection, obfuscation, crypto weakness, environment leaks, and supply-chain attacks. Use when auditing code for security, running pre-commit hooks, or preparing CI/CD security gates."
license: MIT
metadata:
  version: "1.0.0"
  domain: agent-skills
  canonical-name: security_scanner
---
# security-scanner — code security scanner

## Package scope and prerequisites

This catalog ships instructions, not the executable runtime. Python modules, scripts, local services and optional tools named below must be installed separately from the upstream project. Check their availability before running commands; if they are missing, explain the prerequisite instead of claiming execution or results. The host agent may use model tokens while following these instructions.

Détecte les patterns malveillants dans les skills Python, MCP servers, et pipelines.
Combinaison de regex pattern-matching et d'analyse AST Python.

## Usage

```bash
# Scanner un dossier
python -m skills.security_scanner.cli scan skills/ --fail-on critical
python -m skills.security_scanner.cli scan . --format json
python -m skills.security_scanner.cli scan src/main.py --verbose

# Audit complet
python -m skills.security_scanner.cli audit skills/ --format compact
```

## Checks effectués

| Check | Regex | AST | Exemple |
|-------|-------|-----|---------|
| `dangerous_imports` | ✅ | ✅ | `eval(user_input)`, `exec(code)` |
| `network_exfil` | ✅ | ✅ | `requests.post("evil.com")` |
| `filesystem_abuse` | ✅ | ✅ | `open("/etc/passwd", "w")` |
| `subprocess_injection` | ✅ | ✅ | `shell=True` avec input concaténé |
| `obfuscation` | ✅ | ❌ | `base64.b64decode`, `bytes([...]).decode()` |
| `crypto_weak` | ✅ | ❌ | `RSA.generate(512)`, `MD5` |
| `env_leak` | ✅ | ✅ | `print(os.environ["SECRET"])` |
| `supply_chain` | ✅ | ❌ | Imports de packages inconnus |

## Architecture

```
security_scanner/
├── scanner.py     # Orchestrateur : itère fichiers, appelle analyseurs
├── patterns.py    # Base de patterns (regex + metadata)
├── ast_checker.py # Analyse Python AST
├── report.py      # Compilation du rapport
├── rules/         # YAML rules extensibles
├── cli.py         # CLI argparse
└── test_security_scanner.py
```

## Intégration

```bash
# Pre-commit hook
python -m skills.security_scanner.cli scan . --fail-on critical --format compact

# CI/CD
python -m skills.security_scanner.cli scan skills/ --format json --output security-report.json

# Nightly audit
python -m skills.security_scanner.cli audit . --format markdown
```

## Pitfalls

1. **Faux positifs** — `eval` dans un contexte contrôlé (ex: `eval("1+1")`) est signalé.
   L'AST checker permet de filtrer les évaluations statiques.
2. **Fichiers binaires** — Skip automatique (.pyc, .so, .dll, images).
3. **Dossiers ignorés** — .git, node_modules, __pycache__, .venv.
4. **Performance** — Utilise `concurrent.futures` pour scanner en parallèle.