Security Scan

This runs Ruflo security scans across your codebase at three depth levels: quick hits dependencies and CVEs, standard adds input validation and secrets detection, and full goes deep with threat modeling and auth flow analysis. It's basically a wrapper around their CLI tools that stores findings in MCP memory and can train on patterns via post-task hooks. Honest take: the tiered approach is smart for balancing speed versus thoroughness, though you're still dependent on Ruflo's underlying tooling quality. Most useful when you want repeatable security checks that Claude can reference later, less so if you already have a mature security pipeline that does this stuff better.

skills.sh installs: 748
GitHub stars: 81.4K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add ruvnet/ruflo --skill security-scan --agent claude-code

Installs into .claude/skills of the current project.

Files

Run a security scan at the specified depth.

Via CLI:

npx @claude-flow/cli@latest security scan --depth DEPTH --output json
npx @claude-flow/cli@latest security cve --list
npx @claude-flow/cli@latest security threats --model stride --export md

What the scan really does (v3/@claude-flow/cli/src/commands/security.ts): phase 1 runs npm audit for dependencies, phase 2 greps for hard-coded secrets, phase 3 greps source for risky code patterns. --type deps|code|all picks phases; --depth only sets how many directory levels phases 2 and 3 descend: