vulnerability-scanner
Vulnerability scanning principles. DAST, SAST, SCA selection and integration.
Installation
Details
Usage
After installing, this skill will be available to your AI coding assistant.
Verify installation:
skills listSkill Instructions
name: vulnerability-scanner description: Vulnerability scanning principles. DAST, SAST, SCA selection and integration.
Vulnerability Scanner
Scanning tool selection and integration principles.
1. Scanner Type Selection
Decision Tree
What are you scanning?
│
├── Running application
│ └── DAST (Dynamic)
│
├── Source code
│ └── SAST (Static)
│
├── Dependencies
│ └── SCA (Composition)
│
├── Container images
│ └── Container scanners
│
└── Infrastructure
└── Network scanners
Comparison
| Type | Scans | Finds | Stage |
|---|---|---|---|
| DAST | Running app | Runtime issues | Pre-prod |
| SAST | Source code | Code patterns | Development |
| SCA | Dependencies | Known CVEs | Build |
| Network | Infrastructure | Misconfigs | Any time |
2. Tool Selection Principles
DAST Tools
| Scenario | Tool Type |
|---|---|
| Web apps | Web vulnerability scanners |
| APIs | API-aware scanners |
| Authenticated | Session-aware scanners |
SAST Tools
| Scenario | Tool Type |
|---|---|
| Multi-language | Universal scanners |
| Single language | Language-specific |
| Custom rules | Rule-based scanners |
SCA Tools
| Scenario | Tool Type |
|---|---|
| npm/yarn | Package auditors |
| Containers | Image scanners |
| Full SBOM | Comprehensive SCA |
3. CI/CD Integration Principles
Pipeline Stages
| Stage | Scan Type |
|---|---|
| Commit | SAST (fast) |
| Build | SCA |
| Deploy to staging | DAST |
| Pre-production | Full scan |
Gate Criteria
| Severity | Action |
|---|---|
| Critical | Block deployment |
| High | Review required |
| Medium | Log and track |
| Low | Informational |
4. False Positive Management
Triage Workflow
- Auto-filter known false positives
- Context check - is code reachable?
- Manual verify - is it exploitable?
- Document - mark with reason
Baseline Approach
- Create baseline of known issues
- Only alert on new findings
- Review baseline periodically
5. Vulnerability Prioritization
CVSS + Context
| Factor | Consideration |
|---|---|
| CVSS score | Base severity |
| Exploitability | EPSS score |
| Asset criticality | Business impact |
| Exposure | Internet-facing? |
Priority Formula
Priority = CVSS × Exploitability × Asset_Value
6. Reporting Principles
Report Components
| Component | Content |
|---|---|
| Summary | Counts by severity |
| Findings | Details per vulnerability |
| Trends | Change over time |
| Remediation | Fix recommendations |
Metrics to Track
- Vulnerabilities by severity
- Mean time to remediate
- False positive rate
- Coverage percentage
7. Anti-Patterns
| ❌ Don't | ✅ Do |
|---|---|
| Scan only in CI | Scan in multiple stages |
| Alert on everything | Prioritize by risk |
| Ignore false positives | Maintain baseline |
| Scan without context | Consider asset value |
Remember: Scanning finds issues. Prioritization makes them actionable.
More by xenitV1
View allAPI design principles and decision-making. REST vs GraphQL vs tRPC selection, response formats, versioning, pagination. Teaches thinking, not fixed patterns.
Defines different operational modes for AI behavior. Each mode optimizes for specific scenarios like brainstorming, implementation, or debugging.
Database design principles and decision-making. Schema design, indexing strategy, ORM selection, serverless databases. Teaches thinking, not fixed SQL.
Mobile-first design thinking and decision-making for iOS and Android apps. Touch interaction, performance patterns, platform conventions. Teaches principles, not fixed values. Use when building React Native, Flutter, or native mobile apps.