Security scan

Skill shivae372/claude-bootstrap/.claude/skills/security-scan

Security audit skill. Invoke before deploying, after adding auth code, or when reviewing for vulnerabilities. Auto-activates on "security check", "check for vulnerabilities", "pre-deploy audit", "scan for secrets", "is this auth secure". Routes to security-scanner sub-agent.From its SKILL.md

Install

npx -y skills add shivae372/claude-bootstrap --skill security-scan

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
runs commandsInstructs the agent to run 1 command, including `git diff HEAD --name-only`.

SKILL.md

1.8 KB, 371 tokens by cl100k_base, as published. Nobody here has run it

Purpose

Run a security audit using the security-scanner sub-agent. Covers auth, injection, secrets, data exposure, and input validation. Sub-agent runs in isolation — no raw file dumps in main context.

Steps

1. Determine Scope

# Recent changes only
git diff HEAD --name-only

# Specific area (auth, API, etc.)
# User will specify

2. Delegate to Sub-agent

Use the security-scanner agent to: audit [scope — recent changes / auth module / API routes / full project]
Pay special attention to: authentication, authorization checks, input validation, and any hardcoded credentials

3. Present Results

Format as:

## Security Audit

**Risk Level**: [CRITICAL / HIGH / MEDIUM / LOW / CLEAN]

### 🔴 Critical Issues
[Must fix before deployment]

### 🟠 High Issues
[Fix before merge]

### 🟡 Medium Issues  
[Address in next iteration]

### ✅ Clean Areas
[Confirmed secure]

**Recommendation**: [Deploy / Fix critical first / Full security review needed]

4. If Critical Issues Found

Immediately flag:

⛔ DEPLOYMENT BLOCKED: Critical security issue found.
Do not deploy until [specific fix] is applied.

Scope Guide

What user says	Scope to pass to agent
"check auth"	Authentication and session management code
"pre-deploy scan"	All files changed since last deploy
"check this file"	That specific file
"full audit"	Entire project (warn: this will take longer)
"scan for secrets"	Use secret-detector hook + grep patterns

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.