# Scan and Triage Code Vulnerabilities with Frame

Security scan results need source review before teams can trust findings or apply fixes. This skill guides Frame scans, evidence-based triage, patch review, and verification.

## Install

```bash
npx skillstore add lambdasec/frame-security-scan
```

## Metadata

- Status: approved
- Slug: lambdasec-frame-security-scan
- Skillstore revision: r1
- Version status: missing
- Tree hash: bd38aaaa8a74bd89a34596781957a5a6e5c95214182e71a42a46992c0c796d7f
- Author: lambdasec
- GitHub username: lambdasec
- License: Apache-2.0
- Repository: https://github.com/lambdasec/skills/tree/7d791206069498962a85a0f1ba95f7468dcf82f7/skills/frame-security-scan
- Ref: 87c9669baf85385959f9b0a344dc9dfc8d978f9c
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, network, env\_access
- Quality score: 75
- Public page: https://skillstore.pages.dev/skills/lambdasec-frame-security-scan
- Manifest: https://skillstore.pages.dev/api/skills/lambdasec-frame-security-scan/manifest

## Capabilities

- Guide Frame scans of files or directories with severity filters, changed-file selection, baselines, and text, JSON, or SARIF output.
- Distinguish symbolic findings from LLM findings and report scanner-provided severity, CWE, location, and confidence.
- Review source-to-sink flows using a checklist covering attacker control, validation, production reachability, and CWE accuracy.
- Request proposed fix diffs through Frame and require consent before applying source changes.
- Re-scan patched code, compare earlier findings, and report verification outcomes alongside project test results.
- Use connected Frame MCP tools as an alternative to CLI commands, with the same consent requirements.

## Use Cases

- Review Application Vulnerabilities: Scan application code and inspect reported flows before deciding which findings require fixes.
- Triage Security Findings: Separate symbolic and model findings, inspect validation and reachability, and document evidence for each verdict.
- Check Changed Code: Use changed-file scans, baselines, and SARIF output to support repository security checks.

## Prompt Templates

### Scan One File

```
Check whether Frame is installed, then scan [file] locally without AI. Summarize findings and limitations; do not install software without asking.
```

### Triage Directory Findings

```
Scan [directory] without AI and save findings. Review each source-to-sink flow and explain confirmed findings, likely false positives, and unresolved questions.
```

### Review and Verify Fixes

```
Triage [findings file], then propose fixes. Ask before endpoint use or source changes; show diffs, re-scan approved patches, and run project tests.
```

### Assess Changed Code Against a Baseline

```
Scan files changed since [reference] using [baseline file]. Export SARIF, triage new findings, and explain verification limits without changing configuration.
```

## Limitations

- Requires a separately installed Frame CLI or a connected Frame MCP server; the skill does not bundle a scanner.
- Symbolic scanning covers Python, JavaScript, TypeScript, Java, C, C\+\+, and C\#; other languages require optional LLM detection.
- AI detection and fix generation require an OpenAI-compatible endpoint; hosted endpoints receive code snippets and require consent.
- Findings can be missed or incorrect; a clean scan does not establish safety or replace dependency audits.

## Best Practices

- Start with local scanning and obtain consent before sending code to hosted endpoints.
- Inspect attacker control, source-to-sink flow, validation, and reachability before assigning a triage verdict.
- Review diffs, commit or back up work before approved source changes, then re-scan and run project tests.

## Anti Patterns

- Treating low confidence or a clean scan as proof that code is safe.
- Enabling hosted AI or applying source changes without explicit user agreement.
- Suppressing findings or trusting model conclusions without reading the affected code.

## Security Audit

- Audited at: 2026-10-28T06:35:32.988\+00:00
- Summary: All 31 static findings are false positives involving Markdown formatting, authorized tooling, a local endpoint, a repository URL, and an empty credential example. The instructions require consent for hosted AI requests, installation, and source changes. No evidence found of credential theft, unauthorized exfiltration, or prompt injection.

## Stats

- Views: 0
- Downloads: 0
- Favorites: 0
- Popularity score: 0