scan-security -- OWASP-Based Security Vulnerability Detection

Corresponding rule: security.md

Purpose

Detect security vulnerabilities in code via static pattern matching based on OWASP Top 10. Does not auto-fix; reports only suspected items.

Input -- Dynamic Target Resolution

Resolve target directories in this order:

1. CLAUDE.md "Project Structure" section -- extract source code directories
2. If CLAUDE.md is missing or has no structure info: Glob source files (**/*.{ts,tsx,js,jsx,py,java,go,rs}) -- use the top-level directory containing matched files
3. If no source files are found: report status as SHALLOW and state the reason

Default exclusions: node_modules/, .git/, dist/, build/, coverage/ Skill-specific exclusions: *.test.*, *.spec.*, test_*, *_test.* (security test code excluded)

Mandatory Output: Target Resolution Result