Description
security-audit is an agent skill from the ruflo project for scanning code for security problems and vulnerabilities. It covers input validation, prevention of path traversal, detection of known CVEs, and enforcement of secure coding patterns. The skill says when it should run: when code implements authentication or authorization, handles payment processing or user data, creates an API endpoint, handles file uploads, runs database queries, or calls an external API. Those are the places where a mistake is most costly, so the skill is meant to be used as a review step on changes that touch them. It is for developers who want an assistant to look for common weaknesses before a change is merged, and for teams that want a repeatable checklist for sensitive areas. A scanner like this is a review aid and does not prove that code is secure, so it should be used alongside the team's own review and any dedicated security tools. Be careful to run it on code you are allowed to test and to share its findings only with the people who need them. The skill passes Socket and Snyk on skills.sh, and Gen Agent Trust Hub shows a warning. It has about 1,400 installs. Install it with npx skills add https://github.com/ruvnet/ruflo --skill security-audit.…
Highlights
- Scans for input validation and path traversal problems
- Detects known CVEs in the code
- Enforces secure coding patterns
- Triggers on auth, payments, uploads, queries and external APIs
Ratings & Reviews
No ratings yet
Be the first to rate security-audit.
People also visit
security-audit FAQ
What does the audit check?
Input validation, path traversal prevention, CVE detection and secure coding patterns.
When does it run?
When code touches authentication, authorization, payments, user data, API endpoints, file uploads, database queries or external APIs.
Does passing it mean the code is secure?
No. It is a review aid, and it should be used with the team's own review and dedicated security tools.
How do I install it?
Run npx skills add https://github.com/ruvnet/ruflo --skill security-audit.
Which security audits does it have?
On skills.sh, Socket and Snyk pass, and Gen Agent Trust Hub shows a warning.
What are the best security-audit alternatives?
Popular alternatives to security-audit include find-security-vulnerabilities-in-code, cc-skill-security-review and security-review. See all security-audit alternatives