Web Scan — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Web Scan (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Claude Code plugin that performs automated client-side web security assessments. Point it at any domain and it produces a structured Markdown pentest report covering secrets exposure, vulnerable JS libraries, security misconfigurations, XSS sinks, CORS issues, and more — with zero manual setup required.
webscanner runs a fixed 6-step security review against the target's browser-facing attack surface:
| Step | Check | Tools used |
|---|---|---|
| 0 | OS detection + auto-install deps | pip3, uname |
| 1 | Security headers, cookie flags, HTTPS redirect | curl |
| 2 | Sensitive path exposure (.env, .git, Swagger, admin panels, etc.) | curl |
| 3 | HTML analysis — SRI, tabnapping, CSRF, clickjacking, base tag injection, HTML comment secrets | curl |
| 4 | JavaScript analysis — 40+ secret patterns, DOM XSS sinks, prototype pollution, source map exposure | curl, python3 |
| 4b | Vulnerable JS library detection via retire.js CVE database | npx retire (requires Node.js) |
| 5 | CORS misconfiguration testing | curl |
| 6 | Subdomain enumeration + takeover detection via crt.sh | curl, python3 |
Secrets & sensitive data
Vulnerabilities
innerHTML, document.write, eval, location.href, dangerouslySetInnerHTMLSecure, HttpOnly, SameSite).env, .git/config, /actuator/env, Swagger, GraphQL, phpinfoLibrary vulnerabilities
| Dependency | Required | Notes |
|---|---|---|
python3 | Yes | 3.7+ |
curl | Yes | Pre-installed on macOS and most Linux |
pip3 | Yes | Ships with Python 3 |
npx / Node.js | No | Enables Step 4b (retire.js). Without it, library CVE scanning is skipped. |
The plugin auto-installs requests, beautifulsoup4, and dnspython on first run via pip3 install --user. If anything is missing it prints the correct install command for your OS (macOS, Ubuntu/Debian, RHEL, Arch).
Option A — Load directly (no install, development/personal use):
claude --plugin-dir /path/to/web_scanOption B — Install from GitHub (persistent, recommended):
/plugin marketplace add enderphan94/web_scan
/plugin install webscan@enderphan94/webscan:scan <target>The target can be in any of these formats — the plugin normalises it automatically:
/webscan:scan acb.com
/webscan:scan www.acb.com
/webscan:scan https://www.acb.com
/webscan:scan http://staging.acb.com/appThe scan runs all steps and writes a report to client_side_pentest_report.md in your current working directory.
Bug bounty recon
/webscan:scan target.comQuickly maps the client-side attack surface before manual testing — surfaces exposed secrets, vulnerable libraries, and misconfigured headers in one pass.
Pre-release security review
/webscan:scan staging.myapp.comCatch hardcoded API keys, missing security headers, and vulnerable dependencies before shipping to production.
CTF / web challenge
/webscan:scan chall.ctf.example.comAutomates the initial recon phase — checks for exposed .git, source maps, debug endpoints, and JS secrets that are common CTF entry points.
Third-party vendor assessment
/webscan:scan vendor-portal.thirdparty.comAssess the client-side security posture of a vendor's web portal without needing access to their source code.
Internal audit
/webscan:scan https://intranet.company.internalAudit internal web apps for the same issues that external attackers would look for.
The plugin writes client_side_pentest_report.md with:
Token usage depends on the target's JS bundle size and number of findings. Typical ranges:
| Target type | Input tokens | Output tokens | Total |
|---|---|---|---|
| Simple landing page (1–3 JS files) | ~8,000–15,000 | ~3,000–5,000 | ~11,000–20,000 |
| Medium SPA (5–10 JS files) | ~20,000–45,000 | ~5,000–10,000 | ~25,000–55,000 |
| Large app (10+ JS files, many subdomains) | ~50,000–120,000 | ~8,000–20,000 | ~58,000–140,000 |
What drives token usage:
Tip: If you are on a token budget, run against a specific path (/webscan:scan example.com/app) rather than the root to limit the HTML and JS surface crawled.MIT — see LICENSE
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.