🛡️ secscan

Stop your AI coding agent from shipping secrets and eval().
A drop-in security pre-flight skill for Claude Code, Cursor, Codex & Gemini CLI — one standard-library Python file, zero dependencies, zero API keys.

---

繁體中文摘要

AI 寫程式很快,但很容易把密鑰寫死、留下 eval()、用 shell=True、串 SQL 字串。 secscan 是一個給 AI 編程代理用的「出貨前安全預檢 skill」:一個純標準函式庫的 Python 檔案,零依賴、零 API 金鑰,在 commit 或開 PR 前掃一遍,抓出最常見的安全地雷。 直接放進 Claude Code / Cursor / Codex / Gemini CLI 的 skill 流程即可。

---

What it catches

Severity	Examples
🔴 High	hardcoded API keys / AWS / GitHub / Slack / OpenAI keys & private keys, eval()/exec(), os.system, shell=True, SQL built from f-strings
🟠 Medium	credentials assigned to string literals, pickle.loads, yaml.load without SafeLoader, SQL string concatenation
🟡 Low	md5/sha1, random used for security values, plain-text http://

Quickstart

git clone https://github.com/Hayatelin/secscan-skill.git
python secscan-skill/secscan.py .                 # scan the current project
python secscan-skill/secscan.py src --min-severity high
python secscan-skill/secscan.py app.py --json     # machine-readable

No pip install. Python 3.8+. Exit code is non-zero when issues are found, so it drops straight into CI or a pre-commit hook.

$ python secscan.py examples/vulnerable.py
[HIGH] examples/vulnerable.py:8   [os-system] os.system call - shell command execution
[HIGH] examples/vulnerable.py:12  [sql-fstring] SQL built with an f-string - likely SQL injection
[MED ] examples/vulnerable.py:5   [generic-secret] Hardcoded credential assigned to a literal string
secscan: 9 issue(s) - 5 high, 2 medium, 2 low

Use it as an agent skill

This repo is itself an Agent Skill. Point your agent at it and it will run secscan automatically before committing or opening a PR.

• Claude Code: drop SKILL.md + secscan.py into your project's .claude/skills/secscan/ folder (or your skills marketplace). The agent loads it on demand.
• Cursor / Codex / Gemini CLI: add a rule like "Before finishing any code change, run python secscan.py <changed paths> and fix all high-severity findings."

Add # secscan:ignore to a line you've reviewed and want to allow.

Install via pip

pip install secscan-skill           # provides the `secscan` command
secscan . --min-severity high

Use as a GitHub Action

- uses: Hayatelin/secscan-skill@v1
  with:
    path: .
    min-severity: high

No-install alternative (just curl the script):

- run: |
    curl -sSfL https://raw.githubusercontent.com/Hayatelin/secscan-skill/main/secscan.py -o secscan.py
    python secscan.py . --min-severity high

Use as a pre-commit hook

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/Hayatelin/secscan-skill
    rev: v1.0.0
    hooks:
      - id: secscan

How it works (and its limits)

secscan is a fast heuristic scanner (regex rules over text) — it's meant as a zero-friction first line of defense, not a replacement for a full SAST tool. It favors catching the obvious, high-impact mistakes with low setup cost. PRs that add rules or cut false positives are very welcome.

License

MIT — see LICENSE. © 2026 VictorLin.