ck:security

Identify security risks across codebases using STRIDE and OWASP checks.

Updated Mar 30, 2026
One-click install
npx skills add https://github.com/mafvietnam/mafapp --skill ck-security-mafvietnam
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: ck:security
Source: https://github.com/mafvietnam/mafapp/tree/main/.claude/skills/ck-security
Command: npx skills add https://github.com/mafvietnam/mafapp --skill ck-security-mafvietnam

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

STRIDE + OWASP-based security audit framework that scans code for vulnerabilities, categorizes by severity, and can iteratively fix findings using the ck:autoresearch guard pattern.

Core Features & Use Cases

  • Structured STRIDE + OWASP analysis across a given scope
  • Secret detection, dependency audit, and remediation guidance
  • Reusable workflow for pre-release security reviews and compliance prep

Quick Start

Run the audit on your target codebase using the full scope, e.g., /ck:security full.

Frequently Asked Questions about ck:security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run an automated security audit on my codebase?

To run an automated security audit, apply the tool to your specified scope, such as a full project or a subset of files, to generate a prioritized findings report based on STRIDE and OWASP checks.

Can I automatically fix vulnerabilities found during an OWASP scan?

Yes, you can automatically fix vulnerabilities found during an OWASP scan by enabling the optional iterative fix loop, which applies remediation guidance to resolve identified codebase risks.

What does a STRIDE security analysis include for a software project?

A STRIDE security analysis includes structured risk identification, secret detection, and dependency checks across your specified scope to produce a categorized, prioritized findings report.

Does this security audit work on a specific subset of files in a repository?

Yes, the security audit works on any scope you specify, allowing you to target a specific subset of files, a full project, or an entire repository for vulnerability scanning.

What is the best way to prepare for a pre-release security review?

The best way to prepare for a pre-release security review is to execute a structured audit workflow across your codebase to detect secrets, check dependencies, and generate remediation guidance.

When should I not use the automated autofix loop for vulnerability remediation?

You should not use the automated autofix loop unattended; it operates as a guarded fix pattern powered by ck:autoresearch, requiring careful oversight during iterative vulnerability remediation.