Run automated security scans to detect common vulnerabilities like path traversal and SQL injection in your code.
Install
mkdir -p .claude/skills/security-audit && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/1004" && unzip -o skill.zip -d .claude/skills/security-audit && rm skill.zipInstalls to .claude/skills/security-audit
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Comprehensive security scanning and vulnerability detection. Includes input validation, path traversal prevention, CVE detection, and secure coding pattern enforcement. Use when: authentication implementation, authorization logic, payment processing, user data handling, API endpoint creation, file upload handling, database queries, external API integration. Skip when: read-only operations on public data, internal development tooling, static documentation, styling changes.Key capabilities
- →Perform full security scans for vulnerabilities
- →Check for input validation and path traversal flaws
- →Detect SQL injection and XSS risks
- →Scan dependencies for known CVEs
- →Generate security audit reports and threat models
How it works
It executes CLI-based security analysis tools to identify common attack vectors and dependency vulnerabilities against established security patterns.
Inputs & outputs
When to use security-audit
- →Audit API endpoint security
- →Check for SQL injection vulnerabilities
- →Validate input handling
About this skill
Security Audit Skill
Purpose
Comprehensive security scanning and vulnerability detection. Includes input validation, path traversal prevention, CVE detection, and secure coding pattern enforcement.
When to Trigger
- authentication implementation
- authorization logic
- payment processing
- user data handling
- API endpoint creation
- file upload handling
- database queries
- external API integration
When to Skip
- read-only operations on public data
- internal development tooling
- static documentation
- styling changes
Commands
Full Security Scan
Run comprehensive security analysis on the codebase
npx @claude-flow/cli security scan --depth full
Example:
npx @claude-flow/cli security scan --depth full --output security-report.json
Input Validation Check
Check for input validation issues
npx @claude-flow/cli security scan --check input-validation
Example:
npx @claude-flow/cli security scan --check input-validation --path ./src/api
Path Traversal Check
Check for path traversal vulnerabilities
npx @claude-flow/cli security scan --check path-traversal
SQL Injection Check
Check for SQL injection vulnerabilities
npx @claude-flow/cli security scan --check sql-injection
XSS Check
Check for cross-site scripting vulnerabilities
npx @claude-flow/cli security scan --check xss
CVE Scan
Scan dependencies for known CVEs
npx @claude-flow/cli security cve --scan
Example:
npx @claude-flow/cli security cve --scan --severity high
Security Audit Report
Generate full security audit report
npx @claude-flow/cli security audit --report
Example:
npx @claude-flow/cli security audit --report --format markdown --output SECURITY.md
Threat Modeling
Run threat modeling analysis
npx @claude-flow/cli security threats --analyze
Validate Secrets
Check for hardcoded secrets
npx @claude-flow/cli security validate --check secrets
Scripts
| Script | Path | Description |
|---|---|---|
security-scan | .agents/scripts/security-scan.sh | Run full security scan pipeline |
cve-remediate | .agents/scripts/cve-remediate.sh | Auto-remediate known CVEs |
References
| Document | Path | Description |
|---|---|---|
Security Checklist | docs/security-checklist.md | Security review checklist |
OWASP Guide | docs/owasp-top10.md | OWASP Top 10 mitigation guide |
Best Practices
- Check memory for existing patterns before starting
- Use hierarchical topology for coordination
- Store successful patterns after completion
- Document any new learnings
When not to use it
- →When performing read-only operations on public data
- →When working on internal development tooling
- →When making styling changes
Limitations
- →Cannot detect all logical security flaws
- →Requires manual remediation of identified vulnerabilities
How it compares
It provides automated, targeted security checks for specific coding patterns rather than relying on manual code review alone.
Compared to similar skills
security-audit side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| security-audit (this skill) | 3 | 6mo | Review | Intermediate |
| codex-code-review | 1 | 8mo | Review | Intermediate |
| moai-foundation-quality | 0 | 3mo | No flags | Advanced |
| verification-loop | 0 | 4mo | Review | Intermediate |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by ruvnet
View all by ruvnet →You might also like
codex-code-review
tyrchen
Perform comprehensive code reviews using OpenAI Codex CLI. This skill should be used when users request code reviews, want to analyze diffs/PRs, need security audits, performance analysis, or want automated code quality feedback. Supports reviewing staged changes, specific files, entire directories, or git diffs.
moai-foundation-quality
modu-ai
Enterprise code quality orchestrator with TRUST 5 validation, proactive analysis, and automated best practices enforcement
verification-loop
tom237ttkk
A comprehensive verification system for Codex work sessions.
security-scanning-security-sast
sickn33
Static Application Security Testing (SAST) for code vulnerability analysis across multiple languages and frameworks
fix-dependabot-alerts
microsoft
Fix Dependabot security alerts by updating vulnerable npm dependencies. Use when the user mentions "dependabot", "security alerts", "vulnerability", "CVE", or wants to update packages with security issues.
ast-grep-find
parcadei
AST-based code search and refactoring via ast-grep MCP