Security Audit
FreeComprehensive security scanning and vulnerability detection.
Free · Opens the source repo
What Security Audit does
The Security Audit skill provides developers with a robust tool for identifying vulnerabilities in their codebases. It is designed to perform comprehensive security scans that include checks for input validation, path traversal vulnerabilities, SQL injection, cross-site scripting (XSS), and known Common Vulnerabilities and Exposures (CVEs). This skill is particularly useful during critical phases of development, such as implementing authentication and authorization logic, handling user data, and integrating with external APIs. By utilizing this skill, developers can ensure that their applications adhere to secure coding practices and are resilient against common threats.
The skill operates through a series of commands that allow users to perform targeted security checks or conduct a full security scan of their project. For instance, developers can run a complete security analysis using a single command, or they can focus on specific vulnerabilities by executing checks for input validation or SQL injection. Additionally, the skill includes features for generating detailed security audit reports, which can be formatted in various ways to suit team documentation needs. This helps in maintaining transparency and accountability in the development process.
Developers should consider using this skill whenever they are working on sensitive operations such as payment processing or user data handling. It is also beneficial when creating API endpoints or managing file uploads, as these areas are often targeted by attackers. However, it is important to note that this skill is not necessary for read-only operations on public data or for internal development tooling that does not involve security risks. By integrating the Security Audit skill into their workflow, developers can proactively manage vulnerabilities and enhance the overall security posture of their applications.
When to use it
Use this skill during critical development phases involving authentication, authorization, and user data handling.
When not to use it
Avoid using this skill for static documentation, styling changes, or read-only operations on public data.
What you can build with it
API Development
When developing APIs, use this skill to ensure that your endpoints are secure against common vulnerabilities like SQL injection and XSS.
User Authentication
During the implementation of user authentication, utilize the skill to validate input and prevent unauthorized access.
Payment Processing
In projects involving payment processing, run comprehensive scans to safeguard sensitive user financial data from potential threats.
How to install Security Audit
View source1. Install with the skills CLI
npx skills add ruvnet/ruflo/security-audit --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by ruvnetSecurity Audit Skill
Purpose
Comprehensive security scanning and vulnerability detection. Includes input validation, path traversal prevention, CVE detection, and secure coding pattern enforcement.
When to Trigger
- authentication implementation
- authorization logic
- payment processing
- user data handling
- API endpoint creation
- file upload handling
- database queries
- external API integration
When to Skip
- read-only operations on public data
- internal development tooling
- static documentation
- styling changes
Commands
Full Security Scan
Run comprehensive security analysis on the codebase
npx @claude-flow/cli security scan --depth full
Example:
npx @claude-flow/cli security scan --depth full --output security-report.json
Input Validation Check
Check for input validation issues
npx @claude-flow/cli security scan --check input-validation
Example:
npx @claude-flow/cli security scan --check input-validation --path ./src/api
Path Traversal Check
Check for path traversal vulnerabilities
npx @claude-flow/cli security scan --check path-traversal
SQL Injection Check
Check for SQL injection vulnerabilities
npx @claude-flow/cli security scan --check sql-injection
XSS Check
Check for cross-site scripting vulnerabilities
npx @claude-flow/cli security scan --check xss
CVE Scan
Scan dependencies for known CVEs
npx @claude-flow/cli security cve --scan
Example:
npx @claude-flow/cli security cve --scan --severity high
Security Audit Report
Generate full security audit report
npx @claude-flow/cli security audit --report
Example:
npx @claude-flow/cli security audit --report --format markdown --output SECURITY.md
Threat Modeling
Run threat modeling analysis
npx @claude-flow/cli security threats --analyze
Validate Secrets
Check for hardcoded secrets
npx @claude-flow/cli security validate --check secrets
Scripts
| Script | Path | Description |
|---|---|---|
security-scan | .agents/scripts/security-scan.sh | Run full security scan pipeline |
cve-remediate | .agents/scripts/cve-remediate.sh | Auto-remediate known CVEs |
References
| Document | Path | Description |
|---|---|---|
Security Checklist | docs/security-checklist.md | Security review checklist |
OWASP Guide | docs/owasp-top10.md | OWASP Top 10 mitigation guide |
Best Practices
- Check memory for existing patterns before starting
- Use hierarchical topology for coordination
- Store successful patterns after completion
- Document any new learnings
Frequently asked questions about Security Audit
Similar skills
CodeQL Code Scanning
Streamline CodeQL setup and configuration for security analysis.
Security Review
AI-powered codebase security scanner for vulnerabilities.
Integrating SAST into GitHub Actions
Automate SAST scanning in GitHub Actions workflows.
Implementing Semgrep for Custom SAST Rules
Enhance code security with custom Semgrep rules.
Infrastructure as Code Security Scanning
Automate security checks for your IaC deployments.
Implementing GitHub Advanced Security
Automate code scanning and vulnerability detection at scale.