security-audit
ruvnet/ruflo
Comprehensive security scanning for authentication, authorization, payment, and data handling code.
What is security-audit?
Detects vulnerabilities including input validation flaws, path traversal, SQL injection, XSS, CVEs, and hardcoded secrets. Use when implementing authentication, authorization, payment processing, file uploads, database queries, or API endpoints.
- Full codebase security analysis with configurable depth
- Input validation and XSS vulnerability detection
- Path traversal and SQL injection scanning
- CVE detection in project dependencies
- Hardcoded secrets and credentials discovery
- Threat modeling analysis
How to install security-audit
npx skills add https://github.com/ruvnet/ruflo --skill security-audit- Node.js and npm installed
- @claude-flow/cli package available
How to use security-audit
- 1.Run `npx @claude-flow/cli security scan --depth full` for comprehensive analysis
- 2.Use `--check` flag with specific vulnerability type (input-validation, path-traversal, sql-injection, xss) to focus scanning
- 3.Run `npx @claude-flow/cli security cve --scan` to check dependencies for known CVEs
- 4.Execute `npx @claude-flow/cli security validate --check secrets` to find hardcoded credentials
- 5.Generate formatted reports with `npx @claude-flow/cli security audit --report --format markdown`
Use cases
- Scanning authentication and authorization implementations before deployment
- Checking file upload handlers for path traversal vulnerabilities
- Auditing API endpoints for input validation gaps
- Detecting CVEs in dependencies during dependency updates
- Validating payment processing code for security compliance
- Backend developers implementing secure features
- Security engineers conducting code reviews
- DevOps engineers scanning dependencies
- Teams building payment or authentication systems
- Developers handling sensitive user data
security-audit FAQ
Skip for read-only operations on public data, internal development tooling, static documentation, and styling-only changes.
Yes, use the `--path` flag to target specific directories, e.g., `--path ./src/api`.
The CVE scan supports filtering by severity, e.g., `--severity high` to focus on critical vulnerabilities.
Yes, use `npx @claude-flow/cli security validate --check secrets` to identify hardcoded credentials and API keys.
Yes, the audit report supports multiple formats via `--format` flag (e.g., markdown) and can be saved to a file with `--output`.
Full instructions (SKILL.md)
Source of truth, from ruvnet/ruflo.
name: security-audit description: > Comprehensive security scanning and vulnerability detection. Includes input validation, path traversal prevention, CVE detection, and secure coding pattern enforcement. Use when: authentication implementation, authorization logic, payment processing, user data handling, API endpoint creation, file upload handling, database queries, external API integration. Skip when: read-only operations on public data, internal development tooling, static documentation, styling changes.
Security Audit Skill
Purpose
Comprehensive security scanning and vulnerability detection. Includes input validation, path traversal prevention, CVE detection, and secure coding pattern enforcement.
When to Trigger
- authentication implementation
- authorization logic
- payment processing
- user data handling
- API endpoint creation
- file upload handling
- database queries
- external API integration
When to Skip
- read-only operations on public data
- internal development tooling
- static documentation
- styling changes
Commands
Full Security Scan
Run comprehensive security analysis on the codebase
npx @claude-flow/cli security scan --depth full
Example:
npx @claude-flow/cli security scan --depth full --output security-report.json
Input Validation Check
Check for input validation issues
npx @claude-flow/cli security scan --check input-validation
Example:
npx @claude-flow/cli security scan --check input-validation --path ./src/api
Path Traversal Check
Check for path traversal vulnerabilities
npx @claude-flow/cli security scan --check path-traversal
SQL Injection Check
Check for SQL injection vulnerabilities
npx @claude-flow/cli security scan --check sql-injection
XSS Check
Check for cross-site scripting vulnerabilities
npx @claude-flow/cli security scan --check xss
CVE Scan
Scan dependencies for known CVEs
npx @claude-flow/cli security cve --scan
Example:
npx @claude-flow/cli security cve --scan --severity high
Security Audit Report
Generate full security audit report
npx @claude-flow/cli security audit --report
Example:
npx @claude-flow/cli security audit --report --format markdown --output SECURITY.md
Threat Modeling
Run threat modeling analysis
npx @claude-flow/cli security threats --analyze
Validate Secrets
Check for hardcoded secrets
npx @claude-flow/cli security validate --check secrets
Scripts
| Script | Path | Description |
|---|---|---|
security-scan | .agents/scripts/security-scan.sh | Run full security scan pipeline |
cve-remediate | .agents/scripts/cve-remediate.sh | Auto-remediate known CVEs |
References
| Document | Path | Description |
|---|---|---|
Security Checklist | docs/security-checklist.md | Security review checklist |
OWASP Guide | docs/owasp-top10.md | OWASP Top 10 mitigation guide |
Best Practices
- Check memory for existing patterns before starting
- Use hierarchical topology for coordination
- Store successful patterns after completion
- Document any new learnings
Related skills
More from ruvnet/ruflo and the wider catalog.
Skill Builder
Create new Claude Code Skills with proper YAML frontmatter, progressive disclosure structure, and complete directory organization. Use when you need to build custom skills for specific workflows, generate skill templates, or understand the Claude Skills specification.
sparc-methodology
>
stream-chain
Stream-JSON chaining for multi-agent pipelines, data transformation, and sequential workflows
swarm-advanced
Advanced swarm orchestration patterns for research, development, testing, and complex distributed workflows
swarm-orchestration
Multi-agent swarm coordination for complex tasks across multiple files and modules.
V3 CLI Modernization
CLI modernization and hooks system enhancement for claude-flow v3. Implements interactive prompts, command decomposition, enhanced hooks integration, and intelligent workflow automation.