Safety Scan Skill

Goal

Prevent "Insecure Code" from entering the codebase by strictly enforcing security checks.

Flow

Steps

1. Credentials Check (Gitleaks)

Command: gitleaks detect --source . -v (or regex fallback) Check: Are there API Keys, Tokens, or Passwords in the diff?

• If Found: BLOCK COMMIT. Auto-delete or .gitignore the secret. Alert Human.

2. Static Analysis (SAST)

Command: semgrep scan --config=p/security-audit (if installed) OR npm audit / pip-audit. Check: High-Severity vulnerabilities (RCE, SQLi, XSS).

• If Found: BLOCK COMMIT. Invoke ci-autofix to patch.