Scan
Scan codebase for security vulnerabilities
- Type
- Slash Command
- Repository
- jeremylongshore/tons-of-skills-marketplace
- GitHub stars
- 2.8k
- License
- MIT
- Repo last updated
- Sep 27, 2026
What Scan is
Scan is a slash command published in the jeremylongshore/tons-of-skills-marketplace repository on GitHub, which has about 2.8k stars. The repository describes itself as: “Model-agnostic agent-skills platform with a harness-free canonical layer, verified adapters, and the ccpi package manager. Explore at tonsofskills.com.”
A slash command is a reusable prompt saved as a markdown file and run by typing its name after a slash. In Claude Code, custom commands have been merged into skills: a file in .claude/commands/ and a skill folder in .claude/skills/ both create the same kind of command, and existing command files keep working.
Scan gives you a repeatable way to run the same instructions without retyping them, optionally with arguments.
How to install Scan
Claude Code
- Download scan.md from the repository.
- Save it to ~/.claude/commands/ (all projects) or .claude/commands/ (one project). As a skill, you can instead save it as ~/.claude/skills/<name>/SKILL.md.
- Run it by typing / followed by its name.
Claude Cowork
- Turn the command into a skill: create a folder with the file saved as SKILL.md and zip it.
- In Customize → Skills, click +, then upload the ZIP.
- Run it from any task with / and the skill name.
New to extending Cowork? Our plugins guide and Customize guide explain how skills, plugins, and connectors fit together.
Inside the source file
An excerpt from plugins/security/vulnerability-scanner/commands/scan.md, shared under the repository's MIT license. Read the full file on GitHub.
Perform comprehensive vulnerability scanning on the current codebase to identify security issues, CVEs, and potential attack vectors.
Scan Process
- Code Analysis (SAST)
- Scan for common vulnerability patterns
- Identify insecure code practices
- Check for hardcoded secrets
- Analyze authentication/authorization flaws
- Dependency Scanning
- Check npm/pip/composer dependencies for known CVEs
- Identify outdated packages with security patches
- Report transitive dependency vulnerabilities
- Configuration Review
- Analyze security-sensitive configurations
- Check for insecure defaults
- Validate SSL/TLS settings
- Review access control configurations
- Report Generation
- Severity-based categorization (Critical, High, Medium, Low)
- CVE identifiers and CVSS scores
- Remediation recommendations
- Affected files and line numbers
Output Format
Generate a structured vulnerability report with:
- Executive summary with vulnerability counts by severity
- Detailed findings with code snippets
- Remediation steps for each vulnerability
- Links to CVE databases and security advisories
Security Best Practices
- Never expose vulnerability details in public repositories
- Prioritize Critical and High severity issues
- Retest after applying fixes
- Document false positives for future scans
Before you install
- Read the whole file first. Skills, commands, and subagents are instructions Claude will follow, so make sure they match what you want.
- Check which tools, scripts, or MCP servers it uses. Local servers and scripts run with your permissions.
- Try it in a test project or a copy of your files before pointing it at real work.
- Pin the version you tested, and review changes before updating.
- Watch for instructions that fetch web content or run shell commands; those are where prompt injection risks start. See our prompt injection guide.
FAQ
What is Scan?
Scan is a slash command for Claude Code and Claude Cowork from the jeremylongshore/tons-of-skills-marketplace repository on GitHub. Scan codebase for security vulnerabilities
How do I install Scan in Claude Code?
Download scan.md from the repository. Save it to ~/.claude/commands/ (all projects) or .claude/commands/ (one project). As a skill, you can instead save it as ~/.claude/skills/<name>/SKILL.md. Run it by typing / followed by its name.
Can I use Scan in Claude Cowork?
Turn the command into a skill: create a folder with the file saved as SKILL.md and zip it. In Customize → Skills, click +, then upload the ZIP. Run it from any task with / and the skill name.
Is Scan safe to install?
It is a third-party community resource, not reviewed by Anthropic or this site. Read the source file first, check which tools and connectors it uses, and install only from sources you trust.
Similar resources
- Generate Signal Generate trading signals from technical indicators Slash Command · jeremylongshore/tons-of-skills-marketplace
- Generate Rest Api Generate production-ready RESTful APIs with best practices Slash Command · jeremylongshore/tons-of-skills-marketplace
- Generate Tests Generate comprehensive unit tests for source code files Slash Command · jeremylongshore/tons-of-skills-marketplace
- Genkit Flow Architect Designs and implements production-grade Firebase Genkit flows (Node.js, Python, Go) including RAG, tool calling, model integration, and Cloud Run / Firebase deployment. Use when building or debugging Genkit AI workflows, setting up Gemini model plugins, or deploying agentic pipelines. Trigger with \"create a Genkit flow\", \"design AI workflow with Genkit\". Subagent · jeremylongshore/tons-of-skills-marketplace
- Scan Headers Quick security header check for a single URL Slash Command · jeremylongshore/tons-of-skills-marketplace
- Run Load Test Run API load tests with k6, Artillery, or Gatling to measure performance Slash Command · jeremylongshore/tons-of-skills-marketplace
- Scan Movers Scan for top market movers across crypto, stocks, and forex with real-time Slash Command · jeremylongshore/tons-of-skills-marketplace
- Run Integration Run integration test suites with proper setup and teardown Slash Command · jeremylongshore/tons-of-skills-marketplace