security-scan · ruvnet — Claude Code skill: what it does, how to install
Scans a repo at three depths: dependency audit, hard-coded secrets, risky code patterns. Useful before a release or while reviewing a PR.
npx skills add ruvnet/ruflo --skill security-scan -a claude-codeWhat security-scan does
The skill runs three passes over the repo: npm audit on dependencies, a grep for hard-coded secrets, and a grep for risky code patterns. The --depth quick|standard|deep flag only controls how many directory levels the second and third passes descend — 3, 5 or 10. On quick the pattern pass is skipped.
Everything goes through npx @claude-flow/cli@latest. security scan --depth DEPTH --output json does the run, security cve --list prints known CVEs, security threats --model stride --export md writes a threat-model template. That last one is a STRIDE/DREAD/PASTA template and never reads your code.
Findings are pattern matches; the scan does not follow data flow or trace auth logic. Open every hit at the reported line before you pass it on. Ignore matches in comments, error strings, test fixtures and generated bundles such as coverage/ or playwright-report/. At the end memory_store keeps the summary under the security-findings namespace, and hooks_post-task takes the results for pattern training.
What it helps with
- audit dependencies with
npm auditbefore a deploy - hunt down hard-coded keys in source files
- check a PR for security regressions
- list known CVEs for the project
- draft a STRIDE threat model in Markdown
Example prompts for the agent
- Run the security-scan skill at standard depth and list every finding with its file and line.
- Scan this PR at quick depth, secrets in the new files first.
- Do a deep security-scan before the deploy and store the findings.
How to install security-scan
1Skills CLI (Vercel)
npx skills add ruvnet/ruflo --skill security-scan -a claude-code2Manually: put the files in place
~/.claude/skills/security-scan/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/security-scan/
1Skills CLI (Vercel)
npx skills add ruvnet/ruflo --skill security-scan -a codex2Manually: put the files in place
.agents/skills/security-scan/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add ruvnet/ruflo --skill security-scan -a cursor2Manually: put the files in place
.cursor/skills/security-scan/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install ruvnet/ruflo security-scan2Manually: put the files in place
.github/skills/security-scan/SKILL.md1Skills CLI (Vercel)
npx skills add ruvnet/ruflo --skill security-scan -a gemini-cli2Platform CLI
gemini skills install https://github.com/ruvnet/ruflo --path plugins/ruflo-security-audit/skills/security-scanManually: put the files in place
.devin/skills/security-scan/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add ruvnet/ruflo --skill security-scan -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
From the same set104
The whole set →Other versions of security-scan
Similar
Questions about security-scan
How do I install security-scan in Claude Code?
Run npx skills add ruvnet/ruflo --skill security-scan -a claude-code. The skill lands at ~/.claude/skills/security-scan/SKILL.md.
What does security-scan do?
It runs npm audit, then greps for secrets and risky patterns down the depth you pick. Findings can go to MCP memory and to hooks_post-task.
What is the difference between standard and deep?
standard walks 5 directory levels, deep walks 10. Dependencies are checked at both depths, while quick never runs the pattern grep.
Source text
SKILL.md · MIT
---
name: security-scan
description: Run full security scans on the codebase using Ruflo security tools. Use when reviewing PRs for security regressions, auditing auth/input-handling code, before production deploys, or when the user asks for a security check at quick/standard/deep depth.
allowed-tools: Bash(npx *) mcp__plugin_ruflo-core_ruflo__memory_store mcp__plugin_ruflo-core_ruflo__hooks_post-task Read Grep
argument-hint: "[depth: quick|standard|deep]"
---
Run a security scan at the specified depth.
Via CLI:
```bash
npx @claude-flow/cli@latest security scan --depth DEPTH --output json
npx @claude-flow/cli@latest security cve --list
npx @claude-flow/cli@latest security threats --model stride --export md
```
What the scan really does (`v3/@claude-flow/cli/src/commands/security.ts`): phase 1 runs `npm audit` for dependencies, phase 2 greps for hard-coded secrets, phase 3 greps source for risky code patterns. `--type deps|code|all` picks phases; `--depth` only sets how many directory levels phases 2 and 3 descend:
| Depth | Dependencies | Secrets (levels) | Code patterns (levels) |
|-------|--------------|------------------|------------------------|
| quick | yes | 3 | skipped |
| standard | yes | 5 | 5 |
| deep | yes | 10 | 10 |
It is a pattern scanner, not a taint or auth-flow analyser, and `security threats` is a separate STRIDE/DREAD/PASTA template, not a scan of your code. Treat every finding as a lead, not a verdict: open the file at the reported line before reporting it, and drop matches in comments, error strings, generated bundles (`coverage/`, `playwright-report/`) and test fixtures. Say which of the phases above you ran and which you did not.
Store findings via MCP: `mcp__plugin_ruflo-core_ruflo__memory_store({ key: "scan-findings", value: "SUMMARY", namespace: "security-findings" })`
Train patterns: `mcp__plugin_ruflo-core_ruflo__hooks_post-task({ taskId: "security-scan", success: true, storeResults: true })`
© ruvnet · MIT · ruvnet/ruflo
