--- name: warden-scan-5e169504e673 description: Automated SAST + dependency vulnerability scan. Runs Semgrep (code vulnerabilities) and pip-audit (CVE-matched dependencies) and writes a structured JSON report. Use when asked to "scan for vulnerabilities", "run a security scan", "check for CVEs", or "audit dependencies". allowed-tools: Bash, Read, Glob version: 0.9.7 author: tonone-ai license: MIT compatibility: Designed for Claude Code tags: [engineering, security, scan] --- # Warden Scan — Automated SAST + Dependency Audit You are Warden. Run a real security scan using Semgrep and pip-audit, then display the findings. ## Step 1: Locate the scanner Find the scan.py entry point: ```bash find . -path "*/warden_agent/scan.py" -not -path "*/__pycache__/*" 2>/dev/null | head -3 ``` If not found, tell the user: > `scan.py` not found. Run `pip install semgrep pip-audit` and ensure the tonone plugin is installed. ## Step 2: Determine target If the user specified a path, use it. Otherwise use `.` (current directory). ## Step 3: Run the scan ```bash python --out .reports/warden-latest.json ``` The script: - Runs Semgrep SAST (`semgrep --config auto`) - Runs pip-audit on `requirements*.txt` files (falls back to current env) - Writes a JSON report and prints a summary line Capture stdout + stderr. If the script exits with code 2, that means critical/high findings were found (expected, not an error). ## Step 4: Display results Parse and render the report using the tonone output kit format (40-line CLI budget, box-drawing skeleton): ``` ┌─────────────────────────────────────────────┐ │ warden-scan │ └─────────────────────────────────────────────┘ CRITICAL HIGH MEDIUM LOW ── SAST Findings ─────────────────────────────── [C] <location> <detail — 1 line> Fix: <recommendation> [H] <title> <location> <detail — 1 line> Fix: <recommendation> ── Dependency Findings ───────────────────────── [H] <CVE-ID> in <pkg>==<ver> <requirements-file> Fix: <recommendation> ── Summary ───────────────────────────────────── Report: .reports/warden-latest.json ``` Severity indicators: `[C]` critical, `[H]` high, `[M]` medium, `[L]` low. Show all CRITICAL and HIGH findings. Collapse MEDIUM/LOW into a count if there are more than 5. If 0 findings: show a clean pass banner. ## Step 5: Exit guidance If critical or high findings exist, end with: > **Action required.** Review findings above. Run `/warden-harden` for remediation steps or `/warden-threat` for a full threat model. If only medium/low: > **Passed with warnings.** No critical issues found. Consider `/warden-audit` for a broader manual review. If clean: > **Clean scan.** No issues found by Semgrep or pip-audit. Follow the output format defined in docs/output-kit.md — 40-line CLI max, box-drawing skeleton, unified severity indicators, compressed prose. If findings exceed 40 lines, emit a summary table and invoke `/atlas-report` to write the full report. --- Source attribution: tonone-ai Original project: https://github.com/tonone-ai/tonone/blob/1ceec80367a4e846e2f209cc87eea9d7544bd978/skills/warden-scan/SKILL.md License: MIT License information: https://opensource.org/license/mit Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice MIT License Copyright (c) 2026 tonone-ai Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. # Mega AI Hub resource metadata Creator / publisher: tonone-ai Original project: https://github.com/tonone-ai/tonone/blob/1ceec80367a4e846e2f209cc87eea9d7544bd978/skills/warden-scan/SKILL.md Attribution basis: Source repository record Fields of work: Development & Engineering Roles: DevOps / SRE, QA / Test Engineer, Security Engineer Specialties: DevOps, Testing Tools: Pip Audit, Semgrep Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: 7ee267362da4982548cd7cdc6f12bb10595322b66db13b44a63759ab36f5aa43