security-scan
Run full security scans on the codebase using Ruflo security tools. Use when reviewing PRs for security regressions, auditing auth/input-handling code, before production deploys, or when the user asks for a security check at quick/standard/deep depth.
Profile →npx skills add ruvnet/ruflo --skill security-scan --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
Run a security scan at the specified depth. Via CLI: ```bash npx @claude-flow/cli@latest security scan --depth DEPTH --output json npx @claude-flow/cli@latest security cve --list npx @claude-flow/cli@latest security threats --model stride --export md ``` | Depth | Checks | |-------|--------| | quick | Dependencies, known CVEs | | standard | + Input validation, path traversal, secrets | | deep | + Threat modeling, injection vectors, auth flows | Store findings via MCP: `mcp__plugin_ruflo-core_ruflo__memory_store({ key: "scan-findings", value: "SUMMARY", namespace: "security-findings" })` Train patterns: `mcp__plugin_ruflo-core_ruflo__hooks_post-task({ taskId: "security-scan", success: true, storeResults: true })`
npx @claude-flow/cli@latest security scan --depth DEPTH --output json npx @claude-flow/cli@latest security cve --list npx @claude-flow/cli@latest security threats --model stride --export md
What does the security-scan skill do?
Run full security scans on the codebase using Ruflo security tools. Use when reviewing PRs for security regressions, auditing auth/input-handling code, before production deploys, or when the user asks for a security check at quick/standard/deep depth.
How do I install it?
Run `npx skills add ruvnet/ruflo --skill security-scan --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From ruvnet/ruflo, a repository with 67,015 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.