SecureAI-Scan

What it is

SecureAI-Scan run via npx --yes secureai-scan@0.11.0 scan . — an offline Node CLI (no Python interpreter, account, or config required) that auto-detects TS/JS/Python source, MCP config files, and Agent Skill bundles. The summary lists its detections; what it doesn't tell you is how findings are gated, what the exact invocations are, and where the tool deliberately stops.

How it works

Findings are sorted into three evidence tiers: proven (traced dataflow or parsed config fact), likely (resolved sink plus one heuristic hop), and heuristic. A default scan shows only proven + likely; heuristics are opt-in via --paranoid. A call counts as an "LLM call" only if it resolves to a real SDK import (openai, @anthropic-ai/sdk, ai, @google/genai, LangChain, Bedrock), which is the mechanism behind the "zero default false positives" claim.

Package advisories run offline on every scan with asymmetric logic: a CVE fires only when your pinned version is provably inside the affected range, but a documented-malicious package fires even on an ambiguous range, on the reasoning that installing a backdoor is unrecoverable. Skill bundles are scanned as whole directories against deobfuscated text variants (homoglyphs, zero-width splitting, payloads staged in .git/, build/, or *.test.ts), targeting the evasion techniques from Cloak and Detonate (arXiv:2607.02357).

What to do

npx --yes secureai-scan@0.11.0 scan .

Other invocations the page states:

• --output report.sarif — inline findings on PRs and the GitHub Security tab
• secureai-scan bom . — AI-BOM inventory mapped to OWASP LLM Top 10 / EU AI Act needs
• --paranoid — include heuristic-tier findings
• npm run regression — scan real public repos against a committed hand-reviewed baseline, failing on any new proven/likely finding

New in this space: static config scanning for LiteLLM Proxy config.yaml (rules LLC001–LLC003) for hardcoded secrets, plaintext endpoints, and missing guardrails.

Caveats

• Not a general SAST or secrets scanner, and not a container/IaC scanner — the page is explicit that you run it alongside Semgrep/GHAS, not instead. A hardcoded exfiltration address with no LLM-shaped payload is caught only by the offline advisory list (DEP003), not by a dataflow rule.
• Metrics are from a 0.9.0 release candidate, not the pinned 0.11.0: 136/136 tests, 88.08% statement coverage, 6/6 on a labeled malicious-skill corpus, 0 new default-tier findings across 12,676 files in 9 repos. The advisory snapshot is a bundled point-in-time list regenerated by scripts/sync-advisories.js, so freshness depends on that sync.