Low Severity
Published: Nov 2, 2026
# security-sweep
**Claude Code skill: One-prompt vulnerability sweep across multiple projects, servers, and container images — OSV-verified CVEs, KEV/EPSS, reachability, prioritized report**
[](https://github.com/baryonlabs/security-sweep/actions/workflows/ci.yml)
[](https://github.com/baryonlabs/security-sweep/releases)
[](LICENSE)
[Quick Start](#quick-start) · [How It Works](#how-it-works) · [Prioritization](#prioritization) · [Comparison with Other Tools](#what-makes-it-different-from-other-security-tools) · [FAQ](#faq)
**Website:** [baryonlabs.github.io/security-sweep](https://baryonlabs.github.io/security-sweep/)
```text
> /security-sweep:security-sweep ./work Full scan please
● Tools verified: osv-scanner ✓ trivy ✓ govulncheck ✗ (Go estimated via grep)
● Discovery: 6 projects (npm · PyPI · Hex · Go · Cargo + sample secrets)
● Scan → OSV validation → Reachability → Report
● Auto assessment: P0 1 · P1 11 · P2 9 · P3 2
● After code review: P0 0 · P1 6 · P2 15 · P3 2 (12 adjustments, reasons in triage.md)
- go-app GO-2021-0113 P0→P1 language.Parse argument is constant, no external input reaches it
- py-app pyyaml 5.3 P1→P2 Only safe_load used, vulnerable full_load not used
- rust-app smallvec P1→P2 Vulnerable function insert_many not used
● Suggested fix commands (not executed): npm audit fix · mix deps.update sweet_xml · cargo update -p smallvec …
```
<sub>The above is a condensed version of actual results from running this repository's `test/fixtures` in a new Claude Code session. Results from 26 projects on an actual dev machine are in the [examples folder](examples/dev-machine-2026-10-23).</sub>
**Scans with osv-scanner and trivy → Validates all CVE/GHSA IDs via OSV API → Enriches with CISA KEV and EPSS → Determines actual code usage (reachability) → Generates P0~P3 prioritized report.** Read-only by default; nothing installed on servers.
## Why Build This
Similar tools already exist. Each excels in different scopes:
- **secondsky's vulnerability-scanning skill** — Dependency and code scanning procedures for a single repository