flux-security-scan

Analyze code diffs for security vulnerabilities using threat-model patterns.

7|1|Updated Feb 21, 2026

Search Tags:#security #vulnerability #llm #code-review #threat-model #pr-diff

Ready to run

npx skills add https://github.com/Nairon-AI/flux --skill flux-security-scan

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: flux-security-scan
Source: https://github.com/Nairon-AI/flux/tree/main/skills/flux-security-scan
Command: npx skills add https://github.com/Nairon-AI/flux --skill flux-security-scan

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Analyzes code changes for security vulnerabilities using LLM-powered reasoning and threat-model patterns to catch issues before merging.

Core Features & Use Cases

PR reviews, pre-commit checks, and branch comparisons to surface security findings
Threat-model guided analysis across STRIDE categories
Clear remediation guidance aligned with the repository's threat model

Quick Start

Run the flux-security-scan on the current changes to surface security findings.

Frequently Asked Questions about flux-security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan code changes for security vulnerabilities before merging?▼

To scan code changes for security vulnerabilities, this Skill analyzes PR diffs, staged changes, and branch comparisons using LLM reasoning and threat-model patterns. It reads changed files via git and outputs structured findings to guide remediation before merge.

What is LLM-driven security analysis for pull requests?▼

LLM-driven security analysis for pull requests evaluates code diffs against STRIDE threat-model categories to surface flaws. It uses reasoning patterns to identify vulnerabilities in changed files and provides clear remediation guidance aligned with the repository's threat model.

Do I need a threat model file to run a security scan on my code?▼

Yes, you need a threat model file to run a security scan on your code. The Skill requires a threat model at .flux/threat-model.md and a security configuration at .flux/security-config.json to guide the LLM reasoning and categorize findings.

How does threat-model guided analysis work for pre-commit checks?▼

Threat-model guided analysis for pre-commit checks reads staged changes and commits via git, then applies LLM reasoning across STRIDE categories. It surfaces security findings and outputs them to .flux/security/security-findings.json for review before code is committed.

Can I use this security scan for branch comparisons in git?▼

Yes, you can use this security scan for branch comparisons in git. It reads changed files via git diffs between branches, analyzes the changes for security vulnerabilities using LLM reasoning, and outputs structured findings to help secure your codebase.

What is the best way to review PR diffs for security flaws?▼

The best way to review PR diffs for security flaws is using LLM-powered reasoning guided by a repository threat model. This approach analyzes diffs across STRIDE categories and outputs structured security findings with clear remediation guidance.