Security Audit

Runs comprehensive security scans across your codebase, checking for the usual suspects like SQL injection, XSS, path traversal, and hardcoded secrets. Also does CVE scanning on dependencies and can generate full audit reports. The guidance is actually helpful here: it tells you to trigger this for anything touching authentication, payments, or user data, but skip it for documentation and styling work. Commands are granular enough that you can run just input validation checks on a specific path instead of scanning everything. The threat modeling and auto-remediation scripts are nice additions if you're doing serious security work rather than just checking boxes.

skills.sh installs: 1.4K
GitHub stars: 81.4K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add ruvnet/ruflo --skill security-audit --agent claude-code

Installs into .claude/skills of the current project.

Files

Security Audit Skill

Purpose

Comprehensive security scanning and vulnerability detection. Includes input validation, path traversal prevention, CVE detection, and secure coding pattern enforcement.

When to Trigger

authentication implementation
authorization logic
payment processing
user data handling
API endpoint creation
file upload handling
database queries
external API integration

When to Skip

read-only operations on public data
internal development tooling
static documentation
styling changes

Commands

Full Security Scan

Run comprehensive security analysis on the codebase

npx @claude-flow/cli security scan --depth full

Example:

npx @claude-flow/cli security scan --depth full --output security-report.json

Input Validation Check

Check for input validation issues

npx @claude-flow/cli security scan --check input-validation

Example:

npx @claude-flow/cli security scan --check input-validation --path ./src/api

Path Traversal Check

Check for path traversal vulnerabilities

npx @claude-flow/cli security scan --check path-traversal

SKILL.md on GitHub

Details

Repository: github.com/ruvnet/ruflo
Categories: Backend & APIs, Security, Documentation, Finance & Trading, Databases
First seen: Jun 3, 2026