Security Audit Scanner
ruvnet/ruflo
Runs claude-flow CLI security scans for input validation, path traversal, SQL injection, XSS, hardcoded secrets and known CVEs, and writes an audit report.
AI-powered security analysis of code changes — traces data flow, detects injection, auth bypass, secrets exposure, and unsafe deserialization across files.
Install Security Review
$ npx skills add danielvm-git/bigpowers --skill security-review -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install danielvm-git/bigpowers security-review --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/danielvm-git/bigpowers.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/security-review .claude/skills/security-review && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "security-review" agent skill from https://github.com/danielvm-git/bigpowers/tree/main/skills/security-review into .claude/skills/security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-review", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/danielvm-git/bigpowers/tree/main/skills/security-reviewType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add danielvm-git/bigpowers --skill security-review -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install danielvm-git/bigpowers security-review --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/danielvm-git/bigpowers.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/security-review .agents/skills/security-review && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "security-review" agent skill from https://github.com/danielvm-git/bigpowers/tree/main/skills/security-review into .agents/skills/security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-review", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add danielvm-git/bigpowers --skill security-review -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install danielvm-git/bigpowers security-review --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/danielvm-git/bigpowers.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/security-review .cursor/skills/security-review && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "security-review" agent skill from https://github.com/danielvm-git/bigpowers/tree/main/skills/security-review into .cursor/skills/security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-review", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/danielvm-git/bigpowers.git --path skills/security-review--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add danielvm-git/bigpowers --skill security-review -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install danielvm-git/bigpowers security-review --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/danielvm-git/bigpowers.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/security-review .gemini/skills/security-review && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "security-review" agent skill from https://github.com/danielvm-git/bigpowers/tree/main/skills/security-review into .gemini/skills/security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-review", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install danielvm-git/bigpowers security-reviewInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add danielvm-git/bigpowers --skill security-review -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/danielvm-git/bigpowers.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/security-review .github/skills/security-review && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "security-review" agent skill from https://github.com/danielvm-git/bigpowers/tree/main/skills/security-review into .github/skills/security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-review", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add danielvm-git/bigpowers --skill security-review -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install danielvm-git/bigpowers security-review --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/danielvm-git/bigpowers.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/security-review .opencode/skills/security-review && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "security-review" agent skill from https://github.com/danielvm-git/bigpowers/tree/main/skills/security-review into .opencode/skills/security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-review", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
security-review- GitHub stars
- 257
- Token cost
- ~1.5k tokens
- SKILL.md length
- 599 words
- Files
- 12
- Skills in repo
- 39
- Repo updated
- First seen
- Licence
- MIT
At a glance
AI-powered security analysis of code changes — traces data flow, detects injection, auth bypass, secrets exposure, and unsafe deserialization across files.
- Works in 2 steps: Map to a CWE ID in… → Ship two fixture pairs under…
- Reviewing pending changes
- SKILL.md covers Parallel worktree mode (e45s18), 5-phase scan, Categories and CWE mapping mandate (e45s26), plus 6 more sections
- Runs Go, JavaScript, Python and Shell scripts from its folder; calls git and bash
What it does
Security Review is an agent skill from danielvm-git/bigpowers. AI-powered security analysis of code changes — traces data flow, detects injection, auth bypass, secrets exposure, and unsafe deserialization across files. Use when reviewing pending changes, before release-branch, during verify-work Phase 5, during build-epic Step 0 threat modeling, or when the user says "security review" or "scan for vulns".
Its SKILL.md is about 1.5k tokens, which your agent loads only when the skill is triggered. The skill folder holds 12 other files (for example `REFERENCE-confidence-rubric.md`, `REFERENCE-false-positives.md` and `REFERENCE-vuln-categories.md`).
It sits in Security, covering Security review, Threat modeling and Web application vulnerabilities. It works with Git. The repository describes itself as: Agent skills synthesizing years of software engineering discipline into a prescriptive methodology for solo developers. The licence is MIT.
When your agent uses it
- Reviewing pending changes
- Before release-branch
- During verify-work Phase 5
- During build-epic Step 0 threat modeling
Example prompts
- “security review”
- “scan for vulns”
- “/security-review”
Requirements
- Python 3
- Node.js
- A Bash shell
Workflow steps
2 steps, taken from the first numbered list in SKILL.md.
- Map to a CWE ID in REFERENCE-vuln-categories.md (e.g. SQLi → CWE-89, XSS → CWE-79).
- Ship two fixture pairs under skills/security-review/fixtures/
What it can do on your machine
Read from SKILL.md and the folder at commit 812d57a. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Ships script files (Go, JavaScript, Python and Shell), which the agent can run.
Shell commands in SKILL.md call:
gitbash
From the folder's file list and the shell code blocks in SKILL.md.
Network
Links to these hosts (documentation or services it may open):
cwe.mitre.org
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Security Review loads about 1.5k tokens when it runs. Until then it costs about 90 tokens; SKILL.md has 599 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from danielvm-git/bigpowers at commit 812d57a, republished under its MIT licence (© danielvm-git). 599 words, ~1,532 tokens.
Download SKILL.mdSave it as
.claude/skills/security-review/SKILL.md (or your agent's skills folder). This skill also uses 11 other files; get the full folder from GitHub.- name
- security-review
- description
- AI-powered security analysis of code changes — traces data flow, detects injection, auth bypass, secrets exposure, and unsafe deserialization across files. Use when reviewing pending changes, before release-branch, during verify-work Phase 5, during build-epic Step 0 threat modeling, or when the user says "security review" or "scan for vulns".
- model
- sonnet
- effort
- standard
story: e45s41
<!-- story: e45s18 -->story: e26s01
story: e26s02
story: e26s03
story: e26s04
story: e26s05
story: e26s06
story: e26s07
story: e45s26
Security Review
HARD GATE — Requires git context (branch with merge-base or diff). Never writes files outside
specs/security/. Findings below confidence 8/10 are suppressed. Pre-flight:git rev-parse HEAD >/dev/null 2>&1
Parallel worktree mode (e45s18)
When running alongside audit-code, use isolated worktrees so scans do not race on the same index:
bash scripts/lib/parallel-review-worktrees.sh security-reviewEach check gets a detached worktree at .bigpowers/worktrees/review-<name>/; reports still write only under specs/security/.
5-phase scan
| # | Phase | What |
|---|---|---|
| 1 | Scope Resolution | Detect diff via git diff --merge-base origin/HEAD; resolve languages/frameworks from dependency files |
| 2 | Context Research | Identify existing security patterns, sanitization, auth model in the codebase |
| 3 | Vulnerability Assessment | Trace user input → sink; check auth boundaries, crypto, deserialization, path ops |
| 4 | False-Positive Filtering | Cross-check each finding against exclusion rules; reject confidence < 8 |
| 5 | Report Generation | Output structured markdown: file:line, severity, category, exploit scenario, fix |
Categories
Covered: SQLi, XSS, SSRF, command injection, auth bypass, unsafe deserialization, path traversal, IDOR, crypto flaws, secrets exposure, template injection, NoSQLi
CWE mapping mandate (e45s26)
Every new detection rule added to this skill MUST:
- Map to a CWE ID in
REFERENCE-vuln-categories.md(e.g. SQLi → CWE-89, XSS → CWE-79). - Ship two fixture pairs under
skills/security-review/fixtures/:- Positive — minimal code the rule MUST flag (vulnerable pattern present).
- Negative — structurally similar code the rule MUST NOT flag (safe pattern / false-positive guard).
| Rule | CWE | Positive fixture | Negative fixture |
|---|---|---|---|
| SQL injection | CWE-89 | fixtures/CWE-89-sqli-positive.py | fixtures/CWE-89-sqli-negative.py |
| XSS (DOM) | CWE-79 | fixtures/CWE-79-xss-positive.js | fixtures/CWE-79-xss-negative.js |
| Missing tenant scoping (IDOR) | CWE-639 | fixtures/CWE-639-idor-positive.go | fixtures/CWE-639-idor-negative.go |
| Fail-open verify directive | CWE-754 | fixtures/CWE-fail-open-verify-positive.sh | fixtures/CWE-fail-open-verify-negative.sh |
Before merging a new category, run both fixtures through the detection guidance and confirm positive flags / negative passes.
SQL-safety doctrine (e45s41 — proven authorship)
Formal rule for SQL injection classification:
| SQL source | Attacker-reachable input? | Verdict |
|---|---|---|
| Hardcoded / compile-time constant string | N/A | Safe — proven authorship |
| Developer-authored query with bound parameters only | No dynamic fragments from user input | Safe |
| String concatenation / template with user-controlled values | Yes | Unsafe — report as SQLi |
| ORM query builder with user input in WHERE/JOIN | Yes | Unsafe unless parameterized |
| Stored procedure call with bound args | Args from trusted constants only | Safe |
| Stored procedure with dynamic SQL inside | User input reaches EXEC | Unsafe |
Provenance test: If the agent cannot prove the query string was authored entirely by the developer (no attacker-reachable interpolation), treat as vulnerable. Hardcoded SQL in migrations, seeds, and admin scripts is safe; anything reachable from HTTP/CLI/user input is not.
Show full SKILL.md (202 more words)Show less
BCP Plus Integration
This skill maps to BCP Plus dimension 12 (Security & Compliance). When BCP Plus sizing is active, the threat model categories above correspond to sub-elements within dimension 12. The NFR Gate rule applies: standard-expectation items (e.g., "use HTTPS", "hash passwords") score 0 with a one-line rationale; only above-standard security requirements contribute to the dimension 12 count. See docs/references/bcp-plus.md for the full 13-dimension framework and NFR Gate pattern.
Integration points
| Skill | Touchpoint |
|---|---|
build-epic | Step 0 — threat-model epic scope → specs/security/epics/<id>/THREAT_MODEL.md |
plan-work | security: field (none/low/medium/high) on story tasks |
plan-release | +2 WSJF risk boost for HIGH+ risk epics |
audit-code | Checklist: "diff scanned — no unaddressed HIGH findings" |
request-review | Inject threat model categories + false-positive rules into reviewer prompt |
investigate-bug | Security-impact assessment in RCA (NONE→CRITICAL) |
validate-fix | Recurrence hardening check for security bugs |
verify-work | Phase 5 — blocks on HIGH findings ≥ 8 confidence |
release-branch | Hard gate — blocks merge if unresolved HIGH findings |
Report format
Each finding: File:Line — Severity — Category
- Description: how the vulnerability manifests
- Exploit scenario: concrete attack path
- Recommendation: fix with code example
Reference files
- Vuln categories — detection guidance per vuln type
- False positives — hard exclusions + precedent
- Confidence rubric — scoring methodology (0–10)
Verify
→ verify: test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && bash scripts/verify-cwe-fixture-sync.sh >/dev/null && git rev-parse HEAD >/dev/null 2>&1
© danielvm-git, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 11 other files in skills/security-review of danielvm-git/bigpowers.
- SKILL.md
- REFERENCE-confidence-rubric.md
- REFERENCE-false-positives.md
- REFERENCE-vuln-categories.md
- fixtures/CWE-639-idor-negative.go
- fixtures/CWE-639-idor-positive.go
- fixtures/CWE-79-xss-negative.js
- fixtures/CWE-79-xss-positive.js
- fixtures/CWE-89-sqli-negative.py
- fixtures/CWE-89-sqli-positive.py
- fixtures/CWE-fail-open-verify-negative.sh
- fixtures/CWE-fail-open-verify-positive.sh
Open the folder on GitHubat commit 812d57a
Compare with similar skills
Security Review next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Security Review this skilldanielvm-git/bigpowers | 257 | — | ~1.5k | Automated safety check: Pass | MIT | |
| Security Audit Scannerruvnet/ruflo | 74k | 2 repos | ~823 | Automated safety check: Pass | MIT | |
| Vibe Checkbenavlabs/vibe-check | 118 | — | ~1.1k | Automated safety check: Notes | MIT | |
| CybersecurityAgriciDaniel/claude-cybersecurity | 227 | — | ~11k | Automated safety check: Warn | MIT | |
| Security Reviewkklimuk/docx-cli | 216 | — | ~1.7k | Automated safety check: Pass | MIT | |
| Security Reviewsd0xdev/sd0x-harness | 192 | — | ~1.1k | Automated safety check: Pass | MIT |
Similar skills
Vibe Check
benavlabs/vibe-check
Security audit for web apps, especially AI-built ("vibe coded") ones.
Cybersecurity
AgriciDaniel/claude-cybersecurity
Ultimate AI-powered cybersecurity code review skill. An agent skill from AgriciDaniel/claude-cybersecurity.
Security Review
kklimuk/docx-cli
Review code for security vulnerabilities. An agent skill from kklimuk/docx-cli.
Security Review
sd0xdev/sd0x-harness
Security review via Codex exec. An agent skill from sd0xdev/sd0x-harness.
Repo Sentinel
Mathews-Tom/armory
Full security audit for public repositories across 12 attack surfaces: git history, secrets, CI/CD, containers, dependencies, licenses.
More from danielvm-git/bigpowers
All 39 skills in this repoExtract Design
danielvm-git/bigpowers
Extract a Google DESIGN.md file from an HTML prototype (claude.ai/design or any styled page) using Puppeteer, producing machine-readable tokens and AI-generated prose.
Align Grid
danielvm-git/bigpowers
Build editorial/magazine/report webpages on a GENUINE Müller-Brockmann modular grid (International Typographic Style) — not a decorative one.
Assess Impact
danielvm-git/bigpowers
Analyze the blast radius of a proposed change before any code is written.
Audit Code
danielvm-git/bigpowers
Self-review checklist for the coding agent to run before dispatching a reviewer.
Audit Plan
danielvm-git/bigpowers
Evaluate an incoming project plan against bigpowers principles and conventions, surface gaps, and produce a READY/NOT READY verdict before engagement begins.
Compose Workflow
danielvm-git/bigpowers
Chain multiple bigpowers skills into a custom workflow recipe saved in specs/.
Related
Works with
Categories
Questions about Security Review
What does Security Review do?
AI-powered security analysis of code changes — traces data flow, detects injection, auth bypass, secrets exposure, and unsafe deserialization across files. Security Review is an agent skill from danielvm-git/bigpowers. AI-powered security analysis of code changes — traces data flow, detects injection, auth bypass, secrets exposure, and unsafe deserialization across files.
When should I use Security Review?
Security Review fits situations like: reviewing pending changes; before release-branch; during verify-work Phase 5; during build-epic Step 0 threat modeling.
How do I install Security Review in Claude Code?
Run `npx skills add danielvm-git/bigpowers --skill security-review -a claude-code`. Or copy the skill folder (skills/security-review in danielvm-git/bigpowers) into .claude/skills/security-review in your project. Claude Code loads it when a task matches its description.
How do I install Security Review in Codex?
Run `npx skills add danielvm-git/bigpowers --skill security-review -a codex`. Or copy the skill folder (skills/security-review in danielvm-git/bigpowers) into .agents/skills/security-review in your project. Codex loads it when a task matches its description.
Can I use Security Review in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add danielvm-git/bigpowers --skill security-review -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/security-review, .gemini/skills/security-review, .github/skills/security-review and .opencode/skills/security-review in your project.
What does Security Review need to run?
Going by SKILL.md and its folder, Security Review needs Go, JavaScript, Python and a shell for the scripts in its folder and the command-line tools its instructions call (git and bash). Our summary lists: Python 3; Node.js; A Bash shell.
Does Security Review access the network?
SKILL.md names 1 domain. As links in the text: cwe.mitre.org. This is read from the text; nothing was executed.
Is Security Review safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Security Review use?
Security Review is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Security Review use?
About 1.5k tokens (SKILL.md is roughly 6.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Security Review?
Skills that share tags, products or a category with Security Review: Security Audit Scanner (ruvnet/ruflo, 74k stars), Vibe Check (benavlabs/vibe-check, 118 stars), Cybersecurity (AgriciDaniel/claude-cybersecurity, 227 stars) and Security Review (kklimuk/docx-cli, 216 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Security Review?
danielvm-git (a GitHub user) maintains it in danielvm-git/bigpowers, which has 257 GitHub stars. The repository holds 39 skills in this directory. The repository was last updated on September 21, 2026.
Source: danielvm-git/bigpowers on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.