Security Scan
- 651 installs
- 67k repo stars
- Updated August 4, 2026
- ruvnet/ruflo
security-scan is a Claude Code skill that runs configurable-depth security scans on a codebase to surface vulnerabilities, secrets exposure, and misconfigurations before shipping.
About
security-scan is a ruvnet/ruflo security skill that orchestrates Claude Flow CLI scans across quick, standard, and deep depth levels before merges or production deploys. It runs `npx @claude-flow/cli@latest security scan --depth DEPTH --output json`, lists CVEs via `security cve --list`, and exports STRIDE threat models with `security threats --model stride --export md`. Developers invoke it when reviewing PRs for security regressions, auditing authentication and input-handling paths, or responding to a user request for a security check. The skill uses Bash, Read, Grep, `mcp__claude-flow__memory_store`, and `mcp__claude-flow__hooks_post-task` to persist findings and hook post-task workflows, making it suited for agent-driven release gates rather than one-off manual pentests.
- Runs 70+ security rules across code, dependencies, and configuration
- Detects hardcoded credentials, API keys, and sensitive data leaks
- Identifies outdated vulnerable packages and permission issues
- Produces severity-classified reports with remediation steps
- Hard-gate before deployment: review findings then invoke launch checklist
Security Scan by the numbers
- 651 all-time installs (skills.sh)
- +10 installs in the week ending Jul 26, 2026 (Skillselion tracking)
- Ranked #462 of 2,203 Security skills by installs in the Skillselion catalog
- Data as of Aug 5, 2026 (Skillselion catalog sync)
npx skills add https://github.com/ruvnet/ruflo --skill security-scanAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 651 |
|---|---|
| repo stars | ★ 67k |
| Last updated | August 4, 2026 |
| Repository | ruvnet/ruflo ↗ |
How do you run depth-tiered security scans before deploy?
Automatically surface vulnerabilities, secrets exposure, and misconfigurations before shipping.
Who is it for?
Developers and reviewers who need repeatable pre-deploy security scans with selectable depth and STRIDE threat modeling.
Skip if: Formal compliance certification audits or organizations that require dedicated commercial SAST/DAST platforms only.
When should I use this skill?
Reviewing a PR for security regressions, auditing auth or input code, before a production deploy, or when the user requests a security check.
What you get
JSON security scan report, CVE list, STRIDE threat-model markdown export, and post-task hook artifacts.
- JSON security scan report
- STRIDE markdown export
- CVE listing
Files
Run a security scan at the specified depth.
Via CLI:
npx @claude-flow/cli@latest security scan --depth DEPTH --output json
npx @claude-flow/cli@latest security cve --list
npx @claude-flow/cli@latest security threats --model stride --export md| Depth | Checks |
|---|---|
| quick | Dependencies, known CVEs |
| standard | + Input validation, path traversal, secrets |
| deep | + Threat modeling, injection vectors, auth flows |
Store findings via MCP: mcp__claude-flow__memory_store({ key: "scan-findings", value: "SUMMARY", namespace: "security-findings" })
Train patterns: mcp__claude-flow__hooks_post-task({ taskId: "security-scan", success: true, storeResults: true })
Related skills
Entra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets484k1.3kAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.484k1.3k
Openclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72
Better Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.80.9k206
Firebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.80.4k397
Audit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.6k85How it compares
Choose security-scan for full-repo security passes and STRIDE exports; use dependency-check when the primary risk is vulnerable npm packages.
FAQ
What depth levels does security-scan support?
security-scan supports quick, standard, and deep depth levels passed to `npx @claude-flow/cli@latest security scan --depth DEPTH --output json`, letting teams trade scan speed against coverage before deploy.
What outputs does security-scan produce?
security-scan produces JSON scan results, a CVE list from `security cve --list`, and a STRIDE threat-model markdown export from `security threats --model stride --export md`, stored via Claude Flow memory and hooks.