/security:scan [path]
/security:scan                   # Scan current directory
/security:scan src/              # Scan specific directory
/security:scan --secrets-only    # Only check for secrets

SEMGREP=$(which semgrep 2>/dev/null)
GITLEAKS=$(which gitleaks 2>/dev/null)
TRIVY=$(which trivy 2>/dev/null)
echo "Tools: semgrep=$([[ -n $SEMGREP ]] && echo 'yes' || echo 'no'), gitleaks=$([[ -n $GITLEAKS ]] && echo 'yes' || echo 'no')"

# With gitleaks
gitleaks detect --source . --report-format json

# Fallback: Grep patterns
grep -rE "(api[_-]?key|secret|password|token|aws_access).*['\"][a-zA-Z0-9]{16,}" \
  --include="*.{js,ts,py,json,yaml,yml,env,config}" \
  --exclude-dir={node_modules,.git,dist,build}

# SQL Injection patterns
grep -rE "execute\(.*\+|query\(.*\$|\$\{.*\}.*SELECT" --include="*.{js,ts,py}"

# Command Injection patterns
grep -rE "exec\(|spawn\(|system\(" --include="*.{js,ts,py}"

grep -rE "innerHTML|dangerouslySetInnerHTML|v-html|document\.write" \
  --include="*.{js,ts,jsx,tsx,vue}"

# With trivy
trivy fs --scanners vuln .

# Fallback: Check for known vulnerable packages
npm audit --json 2>/dev/null || yarn audit --json 2>/dev/null

agent: security-auditor
skills:
  - security-testing
confirmation: none  # Scan is read-only

## Quick Security Scan
- **Path**: {scanned-path}
- **Date**: {timestamp}
- **Tools**: {tools-used}

## Summary
| Category | Findings |
|----------|----------|
| Secrets | X |
| Injection | X |
| XSS | X |
| Dependencies | X |

## Critical Findings
[List any Critical/High severity items]

## Recommendations
1. [Priority actions]