Опишете задачата
Към всички skills

sast-horusec

aiskillstore · Инструменти

Multi-language static application security testing using Horusec with support for 18+ programming languages and 20+ security analysis tools. Performs SAST scans, secret detection in git history, and provides vulnerability findings with severity classification. Use when: (1) Analyzing code for securi

Оригинален текст · няма потвърден превод на български
Платформи: ClaudeНиво: НапредналоВ индекса: 04.03.2026 г.Обновен в GitHub: 04.03.2026 г.

Теми: sast · horusec · vulnerability-scanning · multi-language · secrets-detection

Първо прочетете инструкцията.

Файлът се зарежда от посочения източник само по ваше действие. Можете да го прочетете тук, да го копирате или да го запазите като .md.

Оригинален SKILL.md
GitHub хранилище
Звезди на репото
428
Лиценз
Не е посочен. Проверете в репозитория.
Последна проверка на записа
Няма посочена дата

Добавете в своя инструмент.

Командата отваря избора на skills от репозитория. Прочетете файла и условията на автора преди изпълнение.

npx skills add aiskillstore/marketplace

Страницата копира текст. Не инсталира и не изпълнява нищо на устройството ви.

Откъс от SKILL.md

Началото на файла на автора, без превод.

Horusec SAST Scanner

Overview

Horusec is an open-source security analysis tool that performs static code analysis across 18+ programming languages using 20+ integrated security tools. It identifies vulnerabilities during development, scans git history for exposed secrets, and integrates seamlessly into CI/CD pipelines for secure SDLC practices.

Supported Languages

C#, Java, Kotlin, Python, Ruby, Golang, Terraform, JavaScript, TypeScript, Kubernetes, PHP, C, HTML, JSON, Dart, Elixir, Shell, Nginx

Quick Start

Run Horusec scan on current project:

# Using Docker (recommended)
docker run -v /var/run/docker.sock:/var/run/docker.sock \
  -v $(pwd):/src horuszup/horusec-cli:latest horusec start -p /src -P $(pwd)

# Local installation
horusec start -p ./path/to/project

Core Workflows

Workflow 1: Local Security Scan

For developers performing pre-commit security analysis:

  1. Navigate to project directory
  2. Run Horusec scan: 
    horusec start -p . -o json -O horusec-report.json
  3. Review JSON output for vulnerabilities
  4. Filter by severity (HIGH, MEDIUM, LOW, INFO)
  5. Address critical and high-severity findings
  6. Re-scan to validate fixes

Workflow 2: CI/CD Pipeline Integration

Progress: [ ] 1. Add Horusec to CI/CD pipeline configuration [ ] 2. Configure output format (JSON for automated processing) [ ] 3. Set severity threshold for build failures [ ] 4. Run scan on each commit or pull request [ ] 5. Parse results and fail build on high-severity findings [ ] 6. Generate security reports for audit trail [ ] 7. Track remediation progress over time

Work through each step systematically. Check off completed items.

Workflow 3: Git History Secret Scanning

For detecting exposed credentials and secrets:

  1. Run Horusec with git history analysis enabled: 
    horusec start -p . --enable-git-history-analysis
  2. Review detected secrets and credentials
  3. Rotate compromised credentials immediately
  4. Add detected patterns to .gitignore and .horusec/config.json
  5. Use git-filter-branch or BFG Repo-Cleaner to remove from history (if needed)
  6. Document incident and update security procedures

Workflow 4: False Positive Management

When managing scan results and reducing noise:

Целият SKILL.md в GitHub