build-loop:security-scan
确定性、模型无关的扫描能快速捕获显而易见的风险与秘密暴露。
运行仓库内扫描脚本会执行代码并访问文件，可能暴露或处理敏感信息。
在推送前对仓库运行确定性 OWASP 风险扫描，检测常见泄露与注入点。
在推送或规划阶段运行确定性的 OWASP 风险扫描脚本，能发现常见的 secrets 泄露、SQL/命令/评估注入、公开可写接口、缺失安全头和 prompt-injection 点。适合在 feature push 前或需要一次全面安全把关时用。它是 model-independent，会把每个问题映射到 OWASP 的 Web/LLM/Agentic ID 并升级到安全评审流程。
▸ 展开 SKILL.md 英文原文
Run before any feature push, during Phase 2 planning, or whenever an agent wants a security pass. Executes a deterministic, model-independent OWASP scanner (scripts/security_scan.py) over the repo — catches the common greppable classes: secrets in source, secrets/tokens in logs, SQL/command/eval injection, public mutating endpoints without rate limiting, missing security headers, prompt-injection sinks — and maps each finding to OWASP Web/LLM/Agentic IDs. The judgment layer (authz logic, tenant scoping, tool-permission scope, agent goal-drift) escalates to the security-reviewer agent + the security-methodology canon.
帮我安装这个 skill：https://raw.githubusercontent.com/tyroneross/build-loop/main/skills/security-scan/SKILL.mdcurl -fsSL "https://raw.githubusercontent.com/tyroneross/build-loop/main/skills/security-scan/SKILL.md"<!-- SPDX-FileCopyrightText: 2025-2026 Tyrone Ross, Jr <46267523+tyroneross@users.noreply.github.com> | SPDX-License-Identifier: Apache-2.0 -->
# Security Scan
The deterministic, **model-independent** complement to the two existing security artifacts:
- `agents/security-reviewer.md` — the LLM judgment grader (Fable-pinned; unavailable when Fable is down).
- `skills/security-methodology/` — the OWASP/NIST/ATLAS canon, knowledge-only ("performs no scans").
This skill RUNS: a stdlib-only Python scanner, no model, no network, no Fable dependency. It exists because of a **named, observed failure** — a GitHub OAuth `access_token` was logged to `console.log` in middleware, shipped, and went unno