Individual skill
security-scan
Run full security scans on the codebase using Ruflo security tools. Use when reviewing PRs for security regressions, auditing auth/input-handling code, before production deploys, or when the user asks for a security check at quick/standard/deep depth.
plugins/ruflo-security-audit/skills/security-scan/SKILL.md
Source commit 722232566ad1fc4e73ba4fefc46d77d380ce61ba
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Network or broad shell
- Last checked
- Nov 6, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 81,199
- Repository last updated
- Nov 7, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- swarm Repository topic
- agentic-ai Repository topic
- agentic-framework Repository topic
- agentic-workflow Repository topic
- autonomous-agents Repository topic
- codex Repository topic
- mcp-server Repository topic
- multi-agent Repository topic
- ai-assistant Repository topic
- multi-agent-systems Repository topic
- security Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Read excerpt
Run a security scan at the specified depth.
Via CLI:
```bash
npx @claude-flow/cli@latest security scan --depth DEPTH --output json
npx @claude-flow/cli@latest security cve --list
npx @claude-flow/cli@latest security threats --model stride --export md
```
What the scan really does (`v3/@claude-flow/cli/src/commands/security.ts`): phase 1 runs `npm audit` for dependencies, phase 2 greps for hard-coded secrets, phase 3 greps source for risky code patterns. `--type deps|code|all` picks phases; `--depth` only sets how many directory levels phases 2 and 3 descend:
| Depth | Dependencies | Secrets (levels) | Code patterns (levels) |
|-------|--------------|------------------|------------------------|
| quick | yes | 3 | skipped |
| standard | yes | 5 | 5 |