Comprehensive security review using STRIDE threat modeling. Scans code, validates findings for exploitability, and outputs structured results. Supports PR review, scheduled scans, and full repository audits. Triggers on /flux:security-review.
From fluxnpx claudepluginhub nairon-ai/flux --plugin fluxThis skill uses the workspace's default tool permissions.
Designs and optimizes AI agent action spaces, tool definitions, observation formats, error recovery, and context for higher task completion rates.
Enables AI agents to execute x402 payments with per-task budgets, spending controls, and non-custodial wallets via MCP tools. Use when agents pay for APIs, services, or other agents.
Compares coding agents like Claude Code and Aider on custom YAML-defined codebase tasks using git worktrees, measuring pass rate, cost, time, and consistency.
You are a senior security engineer conducting a focused security review using LLM-powered reasoning and STRIDE threat modeling. This skill scans code for vulnerabilities, validates findings for exploitability, and outputs structured results.
Adapted from Factory AI security-engineer plugin.
On entry, set the session phase:
PLUGIN_ROOT="${DROID_PLUGIN_ROOT:-${CLAUDE_PLUGIN_ROOT:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}}"
[ ! -d "$PLUGIN_ROOT/scripts" ] && PLUGIN_ROOT=$(ls -td ~/.claude/plugins/cache/nairon-flux/flux/*/ 2>/dev/null | head -1)
FLUXCTL="${PLUGIN_ROOT}/scripts/fluxctl"
$FLUXCTL session-phase set security_review
On completion, reset:
$FLUXCTL session-phase set idle
.flux/threat-model.md (auto-generated if missing via flux-threat-model skill)flux:scope ──────────────────────────────────────────────────────┐
│ │
▼ │
┌──────────────────────┐ │
│ flux-threat-model │ ← Generates STRIDE threat model │
└─────────┬────────────┘ │
↓ .flux/threat-model.md │
┌──────────────────────┐ │
│ flux-security-review │ ← THIS SKILL (scan + validate) │
└─────────┬────────────┘ │
↓ validated-findings.json │
│ │
└───────────────────────────────────────────────────────┘
Security findings feed back into planning
| Input | Description | Required | Default |
|---|---|---|---|
| Mode | pr, full, staged, commit-range | No | pr (auto-detected) |
| Base branch | Branch to diff against | No | Auto-detected from PR |
| Severity threshold | Minimum severity to report | No | medium |
# Check if threat model exists
if [ -f ".flux/threat-model.md" ]; then
echo "Threat model found"
# Check age
DAYS_OLD=$(( ($(date +%s) - $(stat -f %m .flux/threat-model.md 2>/dev/null || stat -c %Y .flux/threat-model.md)) / 86400 ))
if [ $DAYS_OLD -gt 90 ]; then
echo "WARNING: Threat model is $DAYS_OLD days old. Consider regenerating."
fi
else
echo "No threat model found. Generate one first using flux-threat-model skill."
fi
If missing: Auto-generate threat model, then proceed.
# PR mode - scan PR diff
git diff --name-only origin/HEAD...
# Full mode - entire repository
find . -type f \( -name "*.js" -o -name "*.ts" -o -name "*.py" -o -name "*.go" -o -name "*.java" \) | head -500
# Staged mode - staged changes only
git diff --staged --name-only
Load the threat model and scan code for vulnerabilities in each STRIDE category:
For each finding, assess exploitability:
HARD EXCLUSIONS - Automatically exclude:
Only report findings with confidence >= 0.8
Output .flux/security/validated-findings.json:
{
"validation_id": "val-<timestamp>",
"validation_date": "<ISO timestamp>",
"threat_model_path": ".flux/threat-model.md",
"validated_findings": [...],
"false_positives": [...],
"summary": {
"total_scanned": 8,
"confirmed": 5,
"false_positives": 3,
"by_severity": {"critical": 1, "high": 2, "medium": 1, "low": 1}
}
}
Present findings with:
| Severity | Criteria | Examples |
|---|---|---|
| CRITICAL | Immediately exploitable, high impact | RCE, hardcoded production secrets, auth bypass |
| HIGH | Exploitable with some conditions | SQL injection, stored XSS, IDOR |
| MEDIUM | Requires specific conditions | Reflected XSS, CSRF, info disclosure |
| LOW | Difficult to exploit, low impact | Verbose errors, missing security headers |
validated-findings.json generated