Security

Orchestrate parallel agents to scan codebases for vulnerability classes and verify findings against CVEs.

15|6|Updated Apr 20, 2026

Search Tags:#security #vulnerability #audit #compliance #devsecops #code-analysis

Ready to run

npx skills add https://github.com/phnx-labs/agents-cli --skill security-phnx-labs

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: Security
Source: https://github.com/phnx-labs/agents-cli/tree/main/.agents/skills/security
Command: npx skills add https://github.com/phnx-labs/agents-cli --skill security-phnx-labs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill addresses the complexity of manual security audits by orchestrating parallel agents to scan codebases for specific vulnerability classes, ensuring comprehensive coverage while filtering out noise.

Core Features & Use Cases

Parallel Vulnerability Analysis: Dispatches specialized subagents to scan for secrets, injection, auth flaws, XSS, and more simultaneously.
Aggressive False-Positive Filtering: Employs a rigorous verification process to ensure only confirmed, high-confidence issues are reported.
Use Case: Run a pre-launch security sweep on a repository to identify leaked API keys, insecure shell execution patterns, or missing authentication middleware before deployment.

Quick Start

Invoke the security skill to perform a comprehensive vulnerability audit on the current repository for the last 7 days.

Frequently Asked Questions about Security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate a security audit to scan my codebase for vulnerabilities?▼

To automate a security audit, this Skill orchestrates parallel agents to scan your codebase for specific vulnerability classes like secrets, injection, and authentication flaws simultaneously.

How does parallel code analysis filter out false positives during a vulnerability scan?▼

Parallel code analysis filters false positives by employing a rigorous verification process that checks potential threats against current security advisories and known CVEs using web search tools.

Can I run a pre-launch security sweep to find leaked API keys and missing authentication middleware?▼

Yes, you can run a pre-launch security sweep to identify leaked API keys, insecure shell execution patterns, or missing authentication middleware before deploying your repository.

Does this automated security audit work across diverse project structures?▼

Yes, the automated security audit operates across diverse project structures to classify risk surfaces, requiring only read access to the codebase and integration with web search tools.

What is the best way to verify potential security threats against known CVEs?▼

The best way to verify potential threats against known CVEs is to use an automated auditing process that validates findings against current security advisories during the codebase scan.

Are there limitations when scanning for specific vulnerability classes like XSS and injection flaws?▼

The main limitation when scanning for vulnerability classes like XSS and injection flaws is the strict aggressive false-positive filtering, which ensures only confirmed, high-confidence issues are reported.