Source profileQuality 83/100Review permissions

ruvnet/ruflo/.agents/skills/security-audit/SKILL.md

security-audit

Comprehensive security scanning and vulnerability detection. Includes input validation, path traversal prevention, CVE detection, and secure coding pattern enforcement. Use when: authentication implementation, authorization logic, payment processing, user data handling, API endpoint creation, file upload handling, database queries, external API integration. Skip when: read-only operations on public data, internal development tooling, static documentation, styling changes.

Source repository stars: 66,999
Declared platforms: 0
Static risk flags: 1
Last source update: 2026-08-04
Source checked: 2026-08-04

Decision Compatibility Install Workflow Permissions Evidence Source

Decision brief

What it does—and where it fits

Comprehensive security scanning and vulnerability detection. Includes input validation, path traversal prevention, CVE detection, and secure coding pattern enforcement.

Best for

Comprehensive security scanning and vulnerability detection. Includes input validation, path traversal prevention, CVE detection, and secure coding pattern enforcement.

Not for

Tasks that require unconfirmed production actions or broad system permissions.
Environments where the pinned source and install steps cannot be inspected.

Compatibility matrix

Platform support, with evidence labels

Platform	Status	Evidence	What to check
Codex	Not declared	No explicit evidence	Portability before use
Claude Code	Not declared	No explicit evidence	Portability before use
Cursor	Not declared	No explicit evidence	Portability before use
Gemini CLI	Not declared	No explicit evidence	Portability before use

Open the compatibility checker

Installation

Inspect first. Install second.

The source command is displayed only when detected. A safe inspection prompt is always available so your agent can explain every action before execution.

Source-detected install commandSource

npx skills add https://github.com/ruvnet/ruflo --skill ".agents/skills/security-audit"

Safe inspection promptEditorial

Inspect the Agent Skill "security-audit" from https://github.com/ruvnet/ruflo/blob/913f9eaedee92627950544424e50339feaf98271/.agents/skills/security-audit/SKILL.md at commit 913f9eaedee92627950544424e50339feaf98271. List every install step, command, network request, credential, file read/write, external action, and rollback step. Explain whether it fits my task. Do not install or execute anything until I approve.

Workflow

What the source asks the agent to do

01
Purpose
Comprehensive security scanning and vulnerability detection. Includes input validation, path traversal prevention, CVE detection, and secure coding pattern enforcement.
Comprehensive security scanning and vulnerability detection. Includes input validation, path traversal prevention, CVE detection, and secure coding pattern enforcement.
02
When to Trigger
authentication implementation
authentication implementationauthorization logicpayment processing
03
When to Skip
read-only operations on public data
read-only operations on public datainternal development toolingstatic documentation
04
Commands
Run comprehensive security analysis on the codebase
Run comprehensive security analysis on the codebaseCheck for input validation issuesCheck for path traversal vulnerabilities

Permission review

Static risk signals and limitations

Runs scripts

medium · line 29

The documentation asks the agent to run terminal commands or scripts.

npx @claude-flow/cli security scan --depth full

Runs scripts

medium · line 34

The documentation asks the agent to run terminal commands or scripts.

npx @claude-flow/cli security scan --depth full --output security-report.json

Evidence record

Why each signal appears

EvidenceSourceComputedTestedEditorial

Signal	Value	Evidence type	Meaning
Quality score	83/100	Computed	Documentation, specificity, maintenance, and trust rules
Repository stars	66,999	Source	Repository attention, not individual Skill quality
Compatibility	0 platforms	Source	Declared in the catalog source record
Usage guide	automated source guide	Editorial	Generated or reviewed according to the visible evidence level

Pinned source

Provenance and original SKILL.md

Repository: ruvnet/ruflo
Skill path: .agents/skills/security-audit/SKILL.md
Commit: 913f9eaedee92627950544424e50339feaf98271
License: MIT
Collected: 2026-08-04
Default branch: main

View the original SKILL.md

Security Audit Skill

Purpose

Comprehensive security scanning and vulnerability detection. Includes input validation, path traversal prevention, CVE detection, and secure coding pattern enforcement.

When to Trigger

authentication implementation
authorization logic
payment processing
user data handling
API endpoint creation
file upload handling
database queries
external API integration

When to Skip

read-only operations on public data
internal development tooling
static documentation
styling changes

Commands

Full Security Scan

Run comprehensive security analysis on the codebase

npx @claude-flow/cli security scan --depth full

Example:

npx @claude-flow/cli security scan --depth full --output security-report.json

Input Validation Check

Check for input validation issues

npx @claude-flow/cli security scan --check input-validation

Example:

npx @claude-flow/cli security scan --check input-validation --path ./src/api

Path Traversal Check

Check for path traversal vulnerabilities

npx @claude-flow/cli security scan --check path-traversal

SQL Injection Check

Check for SQL injection vulnerabilities

npx @claude-flow/cli security scan --check sql-injection

XSS Check

Check for cross-site scripting vulnerabilities

npx @claude-flow/cli security scan --check xss

CVE Scan

Scan dependencies for known CVEs

npx @claude-flow/cli security cve --scan

Example:

npx @claude-flow/cli security cve --scan --severity high

Security Audit Report

Generate full security audit report

npx @claude-flow/cli security audit --report

Example:

npx @claude-flow/cli security audit --report --format markdown --output SECURITY.md

Threat Modeling

Run threat modeling analysis

npx @claude-flow/cli security threats --analyze

Validate Secrets

Check for hardcoded secrets

npx @claude-flow/cli security validate --check secrets

Scripts

Script	Path	Description
`security-scan`	`.agents/scripts/security-scan.sh`	Run full security scan pipeline
`cve-remediate`	`.agents/scripts/cve-remediate.sh`	Auto-remediate known CVEs

References

Document	Path	Description
`Security Checklist`	`docs/security-checklist.md`	Security review checklist
`OWASP Guide`	`docs/owasp-top10.md`	OWASP Top 10 mitigation guide

Best Practices

Check memory for existing patterns before starting
Use hierarchical topology for coordination
Store successful patterns after completion
Document any new learnings

Alternatives

Compare before choosing

Computed 9032,606

K-Dense-AI/scientific-agent-skills

astropy

Core Python library for astronomy and astrophysics workflows that need Astropy APIs, including units/quantities, coordinates, FITS I/O, tables, time systems, WCS, and cosmology. Use when implementing or debugging astronomical data analysis code with Astropy.

Computed 9023,781

alirezarezvani/claude-skills

pr-review-expert

Use when the user asks to review pull requests, analyze code changes, check for security issues in PRs, or assess code quality of diffs.

Computed 8866,999

ruvnet/ruflo

agent-workflow-automation

Agent skill for workflow-automation - invoke with $agent-workflow-automation

Computed 8823,781

alirezarezvani/claude-skills

research-ops-skills

Use when planning, funding, scoping, or synthesizing enterprise research across workstreams — clinical study design, R&D program finance, market sizing/surveys, or product/user research. Triggers on "design this clinical study", "what sample size", "R&D budget", "burn rate", "capitalize or expense", "TAM SAM SOM", "market sizing", "survey design", "segment the market", "plan user interviews", "usability test", "synthesize research insights". Forks context to route to one of four Research-Operati