scan-code
Plugin check: Run
node "${PLUGIN_ROOT}/scripts/check-version.js"— if it outputs a message, show it to the user before proceeding.
Scan Code
Scan a Power Pages site project's source files and dependencies for security issues. Runs opengrep (static analysis) and trivy (dependency/secret/license scanning), then surfaces findings.
Initial request: $ARGUMENTS
WARNING: Before proceeding, inform the user: "This skill uses opengrep and trivy, only if they are installed on your local machine. These third-party, open-source tools scan your source code and dependencies and might collect or transmit data under their own terms, privacy policies, and data-handling practices. Microsoft does not control these. If you select the AI fallback, the AI service processes your source code. Review your organization's policies and applicable third-party terms before continuing."
Gotchas
- Both tools must be installed. Run
check-tools.jsto verify. If either is missing, offer an agent-driven review fallback (see Step 1.2). - Opengrep exits 1 when findings exist. This is normal behavior, not an error — the script handles it.
- Large output. Both tools can produce large JSON for big projects. The scripts normalize the output into a flat findings list.
- Trivy severity flag only affects vulnerability findings. Secrets and license findings are always returned regardless of the
--severityflag. - Secrets are never shown in full — anywhere. Whenever you read source directly (the agent-driven review) or present a finding, use your judgment to recognize any credential — API keys, tokens, passwords, connection strings, private keys, or any other secret shape (there is no fixed list). Never output its raw value anywhere — your context, the session, chat, logs, a summary, the report, or any other output — not even partially; where a value would otherwise be shown, replace it with a mask (e.g.
********).