ck-security

Automate security audits and vulnerability fixes using STRIDE and OWASP methodologies.

Updated Apr 18, 2026
One-click install
npx skills add https://github.com/lengo0951/pms --skill ck-security-lengo0951
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: ck-security
Source: https://github.com/lengo0951/pms/tree/main/.claude/skills/ck-security
Command: npx skills add https://github.com/lengo0951/pms --skill ck-security-lengo0951

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires npm audit, pip-audit, govulncheck, bundle audit, mvn dependency-check, cargo audit, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the process of security audits, identifying vulnerabilities, and applying fixes to code, reducing the time and effort required for manual security checks.

Core Features & Use Cases

  • Security Audit: Performs a structured STRIDE + OWASP security audit on code.
  • Vulnerability Identification: Categorizes findings by severity and suggests fixes.
  • Iterative Fixing: Applies fixes iteratively using the ck:autoresearch pattern.
  • Use Case: Before a release or after adding sensitive features, use this Skill to ensure your codebase is secure and free of vulnerabilities.

Quick Start

Run a security audit on your codebase with the command: /ck:security src/

Frequently Asked Questions about ck-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate security audits and vulnerability scanning across different codebases?

Automate security audits by scanning codebases using STRIDE and OWASP methodologies. The process identifies vulnerabilities, categorizes findings by severity, and iteratively applies fixes to ensure your code is secure before release.

What is STRIDE analysis and how does it work for code vulnerability identification?

STRIDE analysis is a structured methodology for security audits that identifies and categorizes vulnerabilities in your code. It works by scanning source directories, evaluating findings by severity, and suggesting targeted fixes for iterative remediation.

Do I need specific package audit tools installed to run an OWASP security audit?

Yes, you need appropriate package audit tools installed for your detected stack. The audit process relies on dependencies like npm audit, pip-audit, govulncheck, bundle audit, mvn dependency-check, or cargo audit to scan and identify vulnerabilities.

Can I use this approach to fix vulnerabilities automatically or does it only scan code?

You can fix vulnerabilities automatically because the process supports iterative fixing. Beyond just scanning and categorizing findings by severity, it applies fixes iteratively to remediate identified security issues in your codebase.

What's the best way to run a security audit on a specific source directory?

Run a security audit on a specific source directory by executing the audit command with your target path. This initiates STRIDE and OWASP analysis to scan the code, identify vulnerabilities, and suggest iterative fixes for the findings.