Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →Run full security scans on the codebase using Ruflo security tools. Use when reviewing PRs for security regressions, auditing auth/input-handling code, before production deploys, or when the user asks for a security check at quick/standard/deep depth.
.claude/skills/ruvnet-security-scan/SKILL.md| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-04 | ✗→✓ | ▲ Improved | -37% | 0% |
| case-05 | ✗→✓ | ▲ Improved | -56% | 0% |
| case-06 | ✗→✓ | ▲ Improved | -67% | 0% |
| case-07 | ✗→✓ | ▲ Improved | -65% | 0% |
| case-08 | ✗→✓ | ▲ Improved | -41% | 0% |
Run a security scan at the specified depth.
Via CLI:
bashnpx @claude-flow/cli@latest security scan --depth DEPTH --output json npx @claude-flow/cli@latest security cve --list npx @claude-flow/cli@latest security threats --model stride --export md
| Depth | Checks | |-------|--------| | quick | Dependencies, known CVEs | | standard | + Input validation, path traversal, secrets | | deep | + Threat modeling, injection vectors, auth flows |
Store findings via MCP: mcp__plugin_ruflo-core_ruflo__memory_store({ key: "scan-findings", value: "SUMMARY", namespace: "security-findings" })
Train patterns: mcp__plugin_ruflo-core_ruflo__hooks_post-task({ taskId: "security-scan", success: true, storeResults: true })
| Case | Status | Duration (ms) | Turns | Tokens | Tool calls | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Without | With | Δ | Without | With | Δ | Without | With | Δ | Without | With | Δ | ||
case-22 | pass→pass | 7,894 | 6,490 | -18% | 1 | 1 | 0% | 1,629 | 1,641 | +1% | 0 | 0 | — |
case-01 | fail→fail | 14,226 | 8,661 | -39% | 1 | 1 | 0% | 2,025 | 1,055 | -48% | 0 | 0 | — |
case-02 | fail→fail | 4,302 | 4,257 | -1% | 1 | 1 | 0% | 894 | 476 | -47% | 0 | 0 | — |
case-03 | fail→fail | 10,090 | 11,352 | +13% | 1 | 1 | 0% | 737 | 1,205 | +64% | 0 | 0 | — |
case-04 | fail→pass | 5,729 | 2,708 | -53% | 1 | 1 | 0% | 1,045 | 663 | -37% | 0 | 0 | — |
case-05 | fail→pass | 8,693 | 3,238 | -63% | 1 | 1 | 0% | 1,451 | 635 | -56% | 0 | 0 | — |
case-06 | fail→pass | 10,244 | 2,421 | -76% | 1 | 1 | 0% | 1,760 | 586 | -67% | 0 | 0 | — |
case-07 | fail→pass | 10,083 | 5,023 | -50% | 1 | 1 | 0% | 1,726 | 611 | -65% | 0 | 0 | — |
case-08 | fail→pass | 6,059 | 2,592 | -57% | 1 | 1 | 0% | 1,141 | 668 | -41% | 0 | 0 | — |
case-09 | fail→pass | 8,512 | 5,377 | -37% | 1 | 1 | 0% | 1,447 | 860 | -41% | 0 | 0 | — |
case-10 | fail→pass | 9,056 | 3,256 | -64% | 1 | 1 | 0% | 1,535 | 492 | -68% | 0 | 0 | — |
case-11 | fail→pass | 4,346 | 1,546 | -64% | 1 | 1 | 0% | 685 | 461 | -33% | 0 | 0 | — |
case-12 | fail→pass | 8,801 | 3,742 | -57% | 1 | 1 | 0% | 1,789 | 876 | -51% | 0 | 0 | — |
case-13 | fail→fail | 7,472 | 3,551 | -52% | 1 | 1 | 0% | 1,275 | 377 | -70% | 0 | 0 | — |
case-14 | fail→pass | 7,789 | 1,388 | -82% | 1 | 1 | 0% | 1,337 | 435 | -67% | 0 | 0 | — |
case-15 | fail→pass | 5,672 | 2,546 | -55% | 1 | 1 | 0% | 974 | 511 | -48% | 0 | 0 | — |
case-16 | fail→fail | 5,679 | 6,630 | +17% | 1 | 1 | 0% | 671 | 889 | +32% | 0 | 0 | — |
case-17 | fail→pass | 7,152 | 12,815 | +79% | 1 | 1 | 0% | 1,361 | 2,661 | +96% | 0 | 0 | — |
case-18 | fail→fail | 11,511 | 8,123 | -29% | 1 | 1 | 0% | 2,043 | 421 | -79% | 0 | 0 | — |
case-19 | fail→pass | 17,584 | 21,220 | +21% | 1 | 1 | 0% | 3,464 | 3,974 | +15% | 0 | 0 | — |
case-20 | pass→pass | 9,270 | 9,794 | +6% | 1 | 1 | 0% | 2,148 | 2,514 | +17% | 0 | 0 | — |
case-21 | pass→pass | 9,920 | 10,783 | +9% | 1 | 1 | 0% | 2,115 | 2,516 | +19% | 0 | 0 | — |
DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted, and 20 counted toward the lift figure. The other 2 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +59 percentage points is the difference between those two pass rates over the 20 comparable cases.
Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.
Other measured skills in the registry, with their headline benchmark lift.