vm-vulnerability-scanner

# Vulnerability Scanner Skill

Detects OWASP Top 10 and CWE Top 25 vulnerabilities through static code analysis and pattern matching.

## Brownfield Context

This skill is intended for use against **existing codebases** — scanning inherited or in-production source code for known vulnerability patterns. It does not assume a greenfield or test-driven baseline. When invoked from the Security Analysis Agent or Code Review Agent, it scopes its scan to the files identified in the change impact analysis, not the entire codebase, unless a full-scan is explicitly requested.

## When to Use This Skill

- Running OWASP Top 10 vulnerability scans on existing code
- Checking for CWE Top 25 weaknesses in inherited codebases
- Static analysis scoped to a specific change set or file list
- Pre-release security validation of brownfield changes
- Code review security checks on pull request diffs

## Unitary Function

**ONE RESPONSIBILITY:** Detect known vulnerability patterns (OWASP Top 10, CWE Top 25) in source code

**NOT RESPONSIBLE FOR:**
- Authentication/authorization review (see vm-auth-auditor)
- Data protection assessment (see vm-data-protection-reviewer)
- Compliance validation (see vm-compliance-checker)
- Fixing vulnerabilities (read-only skill)

## Input

```json
{
  "source_path": "Path to source code directory or specific file list",
  "scope": "full|changed_files_only",
  "changed_files": ["optional list from change impact analysis"],
  "languages": ["optional — auto-detected if not provided"],
  "severity_threshold": "critical|high|medium|low"
}
```

## Output

```json
{
  "scan_id": "uuid",
  "generated_by": {
    "skill": "vm-vulnerability-scanner",
    "version": "1.0.0"
  },
  "timestamp": "ISO-8601",
  "source_path": "string",
  "scope": "full|changed_files_only",
  "risk_score": "Critical|High|Medium|Low",
  "summary": {
    "critical": 0,
    "high": 0,
    "medium": 0,
    "low": 0
  },
  "vulnerabilities": [
    {
      "id": "VULN-001",
      "category": "A03:2021-Injection",
      "cwe": "CWE-89",
      "severity": "Critical",
      "title": "SQL Injection",
      "description": "Unsanitized user input in SQL query",
      "location": {
        "file": "path/to/file.py",
        "line": 42,
        "code": "query = \"SELECT * FROM users WHERE id = \" + user_input"
      },
      "remediation": "Use parameterized queries or ORM"
    }
  ]
}
```

## Vulnerabilities Detected

### OWASP Top 10 (2021)
- A01:2021 - Broken Access Control
- A02:2021 - Cryptographic Failures
- A03:2021 - Injection
- A04:2021 - Insecure Design
- A05:2021 - Security Misconfiguration
- A06:2021 - Vulnerable and Outdated Components
- A07:2021 - Identification and Authentication Failures
- A08:2021 - Software and Data Integrity Failures
- A09:2021 - Security Logging and Monitoring Failures
- A10:2021 - Server-Side Request Forgery (SSRF)

### CWE Top 25 Coverage
Detects patterns for CWE-89, CWE-79, CWE-787, CWE-20, CWE-125, CWE-78, CWE-416, CWE-22, CWE-352, and other