VanaraVANARAagentsStar9Subscribe — $10/mo
freeagentv2.0.1✓ verified

vuln-scanner

Use when scanning a project's dependencies, source, config, and container images for known vulnerabilities (CVEs), risky versions, and exposed secrets — then triaging findings and proposing safe, prioritized remediations. Invoke before releases, on dependency bumps, or for periodic supply-chain hygiene.

$npx vanara install vuln-scanner

Free & open source (Apache-2.0) — view the source on GitHub.

Overview

You are an application-security scanning agent. Your job is to keep the software supply chain clean: known-bad dependencies, leaked secrets, and risky configuration are caught and triaged before they ship. A scan that dumps 400 raw findings is not security work — it is noise. Your value is in turning raw scanner output into a short, ranked, actionable list a developer can act on today.

What it covers

Details

Tier
Free
Version
2.0.1
Model
claude-haiku-4-5
Tools
Read, Grep, Glob, Bash
Depth
3 references · 2 examples · 1 runnable scripts
Verification
1/1 runnable checks passing ✓ · last verified 2026-08-28pass-rate over the last 30 verification runs (2026-07-30 → 2026-08-28)
Runs on
Your own Claude Code — no API keys
accessibility-auditorUse when auditing an existing UI for WCAG 2.2 A/AA conformance. Investigates semantics, keyboard operability, focus, color contrast, ARIA, forms, and reduced-motion, then reports findings per success criterion with severity and concrete fixes. Read-only — audits, does not refactor.ai-engineerUse PROACTIVELY when building or hardening LLM-powered features (chatbots, RAG, agents, summarizers, extractors, classifiers). Picks the right pattern (prompt → RAG → tools → agent), the right model tier, and ships with evals, guardrails, and cost/latency budgets.api-designerUse when designing a new HTTP/GraphQL API or changing an existing one — modeling resources, defining endpoint contracts, choosing status codes, pagination, filtering, error envelopes, versioning, and idempotency. Produces a reviewable API contract plus an OpenAPI snippet, not production code.api-documenterUse when documenting an HTTP/REST or GraphQL API for external or internal consumers — turning routes, schemas, or an OpenAPI spec into accurate reference docs with request/response examples, error catalogues, auth, pagination, and a getting-started guide. Read-only; produces docs, not code.app-release-managerUse when preparing a mobile app release or store submission. Walks through versioning, build config, store metadata, and the review-readiness checklist to avoid rejections.budget-plannerUse when building, reviewing, or stress-testing a budget. Turns priorities into a realistic allocation of money, tracks budget vs. actuals, forecasts cash flow and runway, and flags variances and shortfall risks early with concrete corrective actions.
← All agents