/scan

Launch a comprehensive security audit on the current project. Detects vulnerabilities, scans dependencies, checks OWASP Top 10, and generates a structured report.

fusengine@fusengine

GitHub

From plugin

fusengine-agents

2233 skills43 agents33 commands

Install

$ npx -y skills add fusengine/agents --agent claude-code

How it fires

How this command gets triggered: by you, by Claude, or both.

Fires itselfClaude auto-loads it when your prompt matches the work.
You can call itInvoke it directly when you want it.
Slash command/scan

Context preview

What this command does when you run it.

Launch a comprehensive security audit on the current project. Detects vulnerabilities, scans dependencies, checks OWASP Top 10, and generates a structured report.

Command definition

scan.md

description: Launch a comprehensive security audit on the current project. Detects vulnerabilities, scans dependencies, checks OWASP Top 10, and generates a structured report.
argument-hint: "[--full] [--deps-only] [--headers] [--auth] [path]"
disable-model-invocation: false

Security Scan

Execute a comprehensive security audit following the 5-phase workflow.

Usage

`/scan` - Full security audit of current project
`/scan --deps-only` - Dependency audit only
`/scan --headers` - Security headers check only
`/scan --auth` - Authentication patterns audit only
`/scan path/to/dir` - Scan specific directory

Workflow

Phase 1: DETECT

Identify project language and framework automatically:

Scan for marker files (package.json, composer.json, etc.)
Detect framework versions and dependencies
Map to appropriate scan patterns

Phase 2: RESEARCH

Query recent CVEs for the detected stack:

Use Exa to search NVD, OSV.dev, GitHub Advisory
Focus on dependencies found in project
Check for known exploits

Phase 3: SCAN

Run vulnerability patterns and dependency audit:

Execute language-specific grep patterns (OWASP Top 10)
Run `bun ${CLAUDE_PLUGIN_ROOT}/../node_modules/@fusengine/harness/dist/cli/bin.mjs scan <dir>` for automated pattern matching
Execute dependency audit CLI (npm audit, composer audit, etc.)
Detect hardcoded secrets and credentials