flux-security-review

Apply STRIDE threat modeling to identify security threats and output validated_findings.json.

7|1|Updated Feb 21, 2026

Search Tags:#security #vulnerability #audit #threat-modeling #stride #code-review #findings

Ready to run

npx skills add https://github.com/Nairon-AI/flux --skill flux-security-review

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: flux-security-review
Source: https://github.com/Nairon-AI/flux/tree/main/skills/flux-security-review
Command: npx skills add https://github.com/Nairon-AI/flux --skill flux-security-review

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill enables automated, rigorous security reviews of codebases by applying STRIDE threat modeling to identify exploitable vulnerabilities and produce structured findings.

Core Features & Use Cases

STRIDE threat modeling across codebases to uncover vulnerabilities.
Scans code and validates findings for exploitability with structured output.
Supports PR reviews, scheduled scans, and full repository audits.
Generates a validated_findings.json for downstream planning.

Quick Start

Trigger a security review on the target repository to generate a STRIDE threat model and a validated findings report.

Frequently Asked Questions about flux-security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

What is STRIDE threat modeling for codebase security audits?▼

STRIDE threat modeling is a structured approach to identify security vulnerabilities across a codebase. It categorizes threats like spoofing and elevation of privilege to validate exploitable weaknesses and generate structured findings for remediation.

How do I automate security reviews for pull requests?▼

You can automate security reviews for pull requests by applying STRIDE threat modeling to the changed code. This validates exploitability and outputs a validated_findings.json file to drive downstream security planning.

Does the security audit require an existing threat model file?▼

The security audit requires a Git repository with code and a threat-model.md file. If one does not exist, the review process can auto-generate it to drive the STRIDE analysis and produce validated findings.

Can I run a full repository security audit across multiple languages?▼

Yes, you can run a full repository security audit across multiple languages. The STRIDE-based review scans the entire codebase to uncover and validate exploitable weaknesses, generating a structured findings report.

What format does the security vulnerability review output?▼

The security vulnerability review outputs a validated_findings.json file. This structured format captures confirmed exploitable threats discovered during the STRIDE analysis, enabling downstream planning and remediation tracking.