wtf is lets-scan?

lets-scan is a security auditing skill for opencode, an AI coding assistant framework. Rather than being a program you install and run, it is a single instruction file that tells an opencode agent how to methodically review a codebase for common security problems and produce a written report explaining what it found, how confident it is, and how to fix it. The skill checks for twenty categories of common vulnerabilities, including different kinds of injection attacks, broken authentication and access control, weak cryptography, hardcoded secrets, unsafe file access, dependency and supply chain risks, information leakage, and several other well known bug classes. It also has extra checks tailored to popular web frameworks like Express, FastAPI, Django, Spring, ASP.NET, Next.js, and Laravel, folded into the relevant categories instead of running as a separate pass. A scan happens in seven steps: first mapping out the project and its entry points, then scanning for suspicious patterns and reading the surrounding code more closely, rating each finding by how severe and how certain it is, working out how exposed the affected code actually is, running the framework specific checks, writing up each finding with evidence and a concrete fix, and finally producing a summary with the top risks and a prioritized list of recommendations. Importantly, the agent only reports problems, it never changes code on its own unless you separately ask it to apply a fix. Installing it means copying a folder into opencode's skills directory, with no build step or separate program to keep updated. Once installed, you can ask the agent in plain language to audit the whole project, scan a specific folder or vulnerability type, or re-check files you just changed. The authors are upfront about its limits: it relies on pattern matching, so unusual bugs can be missed, and its dependency checks work best when tools like npm audit or pip-audit are already installed on your machine. The project is released under the MIT license.