Security Audit
- 1.2k installs
- 67k repo stars
- Updated August 4, 2026
- ruvnet/ruflo
security-audit provides documented workflows for >
About
The security-audit skill Security Audit Skill Purpose Comprehensive security scanning and vulnerability detection Includes input validation path traversal prevention CVE detection and secure coding pattern enforcement When to Trigger authentication implementation authorization logic payment processing user data handling API endpoint creation file upload handling database queries external API integration When to Skip read-only operations on public data internal development tooling static documentation styling changes Commands Full Security Scan Run comprehensive security analysis on the codebase bash npx claude-flow cli security scan depth full Example bash npx claude-flow cli security scan depth full output security-report json Input Validation Check Check for input validation issues bash npx claude-flow cli security scan check input-validation Example bash npx claude-flow cli security scan check input-validation path src api Path Traversal Check Check for path traversal vulnerabilities bash npx claude-flow cli security scan check path-traversal SQL Injection Check Check for SQL injection vulnerabilities bash npx claude-flow cli security scan check sql-injection XSS Check Check fo.
- authentication implementation
- authorization logic
- payment processing
- user data handling
- API endpoint creation
Security Audit by the numbers
- 1,227 all-time installs (skills.sh)
- +4 installs in the week ending Aug 5, 2026 (Skillselion tracking)
- Ranked #81 of 911 Databases skills by installs in the Skillselion catalog
- Security screen: MEDIUM risk (skills.sh audit)
- Data as of Aug 5, 2026 (Skillselion catalog sync)
security-audit capabilities & compatibility
- Capabilities
- authentication implementation · authorization logic · payment processing · user data handling · api endpoint creation
- Use cases
- documentation
What security-audit says it does
# Security Audit Skill ## Purpose Comprehensive security scanning and vulnerability detection.
Includes input validation, path traversal prevention, CVE detection, and secure coding pattern enforcement.
npx skills add https://github.com/ruvnet/ruflo --skill security-auditAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 1.2k |
|---|---|
| repo stars | ★ 67k |
| Security audit | 2 / 3 scanners passed |
| Last updated | August 4, 2026 |
| Repository | ruvnet/ruflo ↗ |
How do I use security-audit for the task described in its SKILL.md triggers?
>
Who is it for?
Teams invoking security-audit when the user request matches documented triggers and prerequisites.
Skip if: Skip when cached docs are missing, the request is a negative trigger, or another sibling skill owns the workflow.
When should I use this skill?
>
What you get
Step-by-step guidance grounded in security-audit documentation and reference files.
- CVE scan output
- remediated lockfile
- per-check security scan logs
By the numbers
- Runs 5 targeted security scan checks: input-validation, path traversal, SQL injection, XSS, and secrets
- CVE workflow includes a high-severity-first scan pass before full re-scan
Files
Security Audit Skill
Purpose
Comprehensive security scanning and vulnerability detection. Includes input validation, path traversal prevention, CVE detection, and secure coding pattern enforcement.
When to Trigger
- authentication implementation
- authorization logic
- payment processing
- user data handling
- API endpoint creation
- file upload handling
- database queries
- external API integration
When to Skip
- read-only operations on public data
- internal development tooling
- static documentation
- styling changes
Commands
Full Security Scan
Run comprehensive security analysis on the codebase
npx @claude-flow/cli security scan --depth fullExample:
npx @claude-flow/cli security scan --depth full --output security-report.jsonInput Validation Check
Check for input validation issues
npx @claude-flow/cli security scan --check input-validationExample:
npx @claude-flow/cli security scan --check input-validation --path ./src/apiPath Traversal Check
Check for path traversal vulnerabilities
npx @claude-flow/cli security scan --check path-traversalSQL Injection Check
Check for SQL injection vulnerabilities
npx @claude-flow/cli security scan --check sql-injectionXSS Check
Check for cross-site scripting vulnerabilities
npx @claude-flow/cli security scan --check xssCVE Scan
Scan dependencies for known CVEs
npx @claude-flow/cli security cve --scanExample:
npx @claude-flow/cli security cve --scan --severity highSecurity Audit Report
Generate full security audit report
npx @claude-flow/cli security audit --reportExample:
npx @claude-flow/cli security audit --report --format markdown --output SECURITY.mdThreat Modeling
Run threat modeling analysis
npx @claude-flow/cli security threats --analyzeValidate Secrets
Check for hardcoded secrets
npx @claude-flow/cli security validate --check secretsScripts
| Script | Path | Description |
|---|---|---|
security-scan | .agents/scripts/security-scan.sh | Run full security scan pipeline |
cve-remediate | .agents/scripts/cve-remediate.sh | Auto-remediate known CVEs |
References
| Document | Path | Description |
|---|---|---|
Security Checklist | docs/security-checklist.md | Security review checklist |
OWASP Guide | docs/owasp-top10.md | OWASP Top 10 mitigation guide |
Best Practices
1. Check memory for existing patterns before starting 2. Use hierarchical topology for coordination 3. Store successful patterns after completion 4. Document any new learnings
#!/bin/bash
# Security Audit - CVE Remediation Script
# Auto-remediate known CVEs
set -e
echo "Scanning for CVEs..."
npx @claude-flow/cli security cve --scan --severity high
echo "Attempting auto-remediation..."
npm audit fix
echo "Re-scanning after remediation..."
npx @claude-flow/cli security cve --scan
echo "CVE remediation complete"
#!/bin/bash
# Security Audit - Full Scan Script
# Run comprehensive security scan pipeline
set -e
echo "Running full security scan..."
# Input validation
echo "Checking input validation..."
npx @claude-flow/cli security scan --check input-validation
# Path traversal
echo "Checking path traversal..."
npx @claude-flow/cli security scan --check path-traversal
# SQL injection
echo "Checking SQL injection..."
npx @claude-flow/cli security scan --check sql-injection
# XSS
echo "Checking XSS..."
npx @claude-flow/cli security scan --check xss
# Secrets
echo "Checking for hardcoded secrets..."
npx @claude-flow/cli security validate --check secrets
# CVE scan
echo "Scanning dependencies for CVEs..."
npx @claude-flow/cli security cve --scan
echo "Security scan complete"
Related skills
Lark BaseLet their coding agents read from, write to, and query structured data stored in Lark Base (Feishu) spreadsheets and databases.493k
Azure KustoRun fast KQL queries against Azure Data Explorer for log analytics, telemetry, and time-series data.484k1.3k
Lark SheetsCreate, read, update, and export spreadsheets inside Lark (Feishu) directly from their AI coding agent.389k15.9k
Supabase Postgres Best PracticesAutomatically apply Supabase Postgres performance rules during query writing, schema design, and database optimization.313k2.4k
Firebase Data ConnectGenerate complete, production-ready Firebase Data Connect GraphQL schemas and queries for complex relational data models.112k392Firebase FirestoreAdd Cloud Firestore read/write capabilities to an Android Kotlin app using the official Firebase SDK.77k392Forks & variants (1)
Security Audit has 1 known copy in the catalog totaling 132 installs. They canonicalize to this original listing.
- ruvnet - 132 installs
How it compares
Pick security-audit when you want a lightweight Claude Flow CLI plus npm audit script; use dedicated SAST platforms for policy dashboards and multi-language coverage.
FAQ
What does security-audit do?
>
When should I use security-audit?
>
What are common prerequisites?
--- name: security-audit description: > Comprehensive security scanning and vulnerability detection.
Is Security Audit safe to install?
skills.sh reports 2 of 3 security scanners passed. Review the Security Audits panel on this page before installing in production.