ScriptSnoop is a lightweight Python tool that scans .py, .sh, .bat, .ps1, .rb, .php, and .js files for risky and potentially dangerous code patterns. It detects issues like destructive deletes, remote code execution, hardcoded secrets, privilege escalation, code injection, and obfuscation techniques — all with no external dependencies.

Built for developers, security auditors, and DevSecOps pipelines.

• 27 detection rules across 4 severity levels (up from ~9 rules in v1.0)
• Severity system — CRITICAL, HIGH, MEDIUM, LOW with color-coded terminal output
• CLI arguments via argparse — no more editing the script to change paths
• Export reports in JSON, CSV, or HTML formats
• Severity filtering — focus only on what matters (e.g. --min-severity HIGH)
• CI/CD ready — exits with code 1 if issues found, 0 if clean
• Deduplication fix — no more duplicate findings on the same line
• 7 file types supported (up from 3)
• --list-rules flag to see all 27 rules at a glance

• Python 3.6 or higher
• No external packages needed — uses only Python standard library

1. Ensure Python 3.6+ is installed. Check with:

   python --version

   or

   python3 --version

2. Download or clone the repository:

   git clone https://github.com/logesh-GIT001/scriptsnoop.git
   cd scriptsnoop

3. No pip install required — the tool runs directly.

Simply run the script and it will prompt you for a folder path:

python3 scriptsnoop.py

You will see:

Enter folder path to scan (or press Enter for current folder):

Press Enter to scan the current folder, or type a path like /home/user/myproject.

Scan a specific directory:

python3 scriptsnoop.py --path ./myproject

Short form using -p:

python3 scriptsnoop.py -p ./myproject

Scan the current directory:

python3 scriptsnoop.py --path .

Color-coded findings grouped by severity — CRITICAL in red, HIGH in orange, MEDIUM in yellow, LOW in cyan — followed by a scan summary table.

A standalone browser dashboard generated with --output report.html. Includes severity stat cards at the top and a full sortable findings table. No internet connection required to view it.

python3 scriptsnoop.py --path ./myproject --output report.html

Structured JSON with full scan metadata and every finding as an object — pipe into other tools, dashboards, or SIEM systems.

python3 scriptsnoop.py --path ./myproject --output report.json

Scan a folder and show all findings:

python3 scriptsnoop.py --path ./myproject

Show only CRITICAL and HIGH findings:

python3 scriptsnoop.py --path ./myproject --min-severity HIGH

Export findings as a JSON report:

python3 scriptsnoop.py --path ./myproject --output report.json

Export findings as a CSV file:

python3 scriptsnoop.py --path ./myproject --output report.csv

Export findings as an HTML report (opens in any browser):

python3 scriptsnoop.py --path ./myproject --output report.html

Explicitly set format with --format:

python3 scriptsnoop.py --path ./myproject --output results.json --format json

Scan only Python and shell files:

python3 scriptsnoop.py --path ./myproject --ext "*.py" "*.sh"

Quiet mode — summary only, no per-finding output:

python3 scriptsnoop.py --path ./myproject --quiet

Disable colors (useful for logging to a file):

python3 scriptsnoop.py --path ./myproject --no-color

List all 27 detection rules:

python3 scriptsnoop.py --list-rules

Combine flags:

python3 scriptsnoop.py --path ./myproject --min-severity HIGH --output report.html --quiet

ScriptSnoop v2.0 includes 27 rules across 4 severity levels.

python3 scriptsnoop.py --path ./myproject --output report.json

Produces a structured JSON file with scan metadata and all findings. Suitable for integrating with other security tools or dashboards.

python3 scriptsnoop.py --path ./myproject --output report.csv

Produces a spreadsheet-compatible file with columns: rule_id, severity, category, file, line, description, content.

python3 scriptsnoop.py --path ./myproject --output report.html

Produces a standalone HTML dashboard you can open in any browser. Shows severity counts at the top and a full findings table. No internet connection required to view it.

ScriptSnoop exits with:

• 0 — no issues found (pipeline passes)
• 1 — one or more findings (pipeline fails)

Create .github/workflows/scriptsnoop.yml in your repository:

name: ScriptSnoop Security Scan

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.x'

      - name: Run ScriptSnoop
        run: python3 scriptsnoop.py --path . --min-severity HIGH --no-color --quiet

This will automatically scan your repository on every push or pull request and fail the pipeline if any HIGH or CRITICAL issues are found.

1. ScriptSnoop recursively finds all supported files in the target directory.
2. Each file is read line by line.
3. Pure comment lines are skipped (supports #, //, /*, rem, :: depending on file type).
4. Inline trailing comments are stripped before matching to reduce false positives.
5. Each line is tested against all 27 regex patterns.
6. Findings are deduplicated per (line_number, rule_id) pair — no duplicate reports.
7. ScriptSnoop never scans itself to avoid false positives.
8. Results are printed to the terminal and optionally exported.

• False positives are possible. Some patterns like requests.get (RP023) or hardcoded IPs (RP022) may appear in legitimate code. Always review findings manually before taking action.
• ScriptSnoop performs static analysis only — it does not execute any code.
• Inline comments are stripped before matching, but multi-line block comments (e.g. """docstrings""") are not fully excluded.
• The tool is designed to be extended easily — add new rules to the RISKY_PATTERNS list in scriptsnoop.py.

Open scriptsnoop.py and add a new entry to the RISKY_PATTERNS list:

{
    "id": "RP028",
    "pattern": r'your_regex_pattern_here',
    "severity": "HIGH",          # CRITICAL, HIGH, MEDIUM, or LOW
    "description": "What this rule detects",
    "category": "Your Category",
},

Then run python3 scriptsnoop.py --list-rules to confirm your rule appears.

scriptsnoop/
├── scriptsnoop.py              # Main scanner — all logic in one file
├── README.md                   # This file
├── terminal_screenshot.png     # Terminal output example
├── html_report_screenshot.png  # HTML report example
└── json_screenshot.png         # JSON output example

logesh-GIT001 GitHub: https://github.com/logesh-GIT001

This project is open source. Feel free to use, modify, and contribute.