security-check

Your AI Becomes a Security Team. Every Language. Every Layer. Zero Tools.

Install

npx skills add ersinkoc/security-check

That’s it. Open your AI assistant and say “run security check”.

---

⚡ Sponsored by WrongStack

🧩 The perfect pairing: Plan with Project Architect, then hand the generated PROMPT.md to WrongStack for spec-driven, single-shot execution. Architect the what and the how — WrongStack ships it.

---

Alternative Installation

What is security-check?

A collection of 51 agent skills following the agentskills.io standard that transforms your AI coding assistant into a comprehensive security scanning team. No binaries, no dependencies, no CI pipeline changes — just natural language prompts.

It is not a traditional SAST tool. It uses LLM reasoning to understand code context, trace data flows across function boundaries, and evaluate framework-level protections. The result: fewer false positives and deeper analysis than pattern-matching tools.

Supported Platforms

See docs/SUPPORTED_PLATFORMS.md for detailed platform-specific setup.

Usage

After installation, tell your AI assistant:

Claude Code menu

Open Claude Code’s / menu and select /security-check. The launcher asks for the unresolved audit profile, scope, validation mode, and prior-report behavior using native selection cards. Explicit choices in the original prompt are not asked again.

The npx skills installation exposes the repository as the security-check bundle. The shell and manual installers additionally expand the 51 scanning skills into sibling directories while installing the same /security-check launcher.

Default choices are non-destructive: Standard, Whole repository, Source only, and Continue and revalidate. Selecting Changed files switches to diff mode; selecting Replace explicitly authorizes replacement of the previous report.

51 Skills Included

Skill Structure (agentskills.io format)

Each skill follows the Agent Skills specification:

sc-sqli/
├── SKILL.md          # Metadata + detection instructions
└── references/       # Checklists (for language skills)

By Category

Language Scanners

Each language scanner uses a dedicated 400+ item checklist with specific CWE references:

How It Works

PHASE 1: RECON           Architecture mapping, tech stack detection, dependency audit
         │
         ▼
PHASE 2: HUNT            40+ vulnerability skills run in parallel
         │
         ▼
PHASE 3: VERIFY          False positive elimination, confidence scoring (0-100)
         │
         ▼
PHASE 4: REPORT          CVSS severity classification, remediation roadmap
         │
         ▼
OUTPUT:  security-report/SECURITY-REPORT.md

The four phases are evidence-led: reconnaissance seeds a coverage ledger, hunters produce candidates, and a separate verification pass tries to disprove each candidate. Only a demonstrated trust-boundary failure is confirmed; unresolved source-grounded leads remain needs_validation without severity. See Evidence and Coverage Model.

Output

After a scan, the security-report/ directory contains:

Adding Custom Skills

1. Copy templates/SKILL_TEMPLATE.md for vulnerability skills
2. Copy templates/LANG_SKILL_TEMPLATE.md for language skills
3. Follow the agentskills.io specification

See docs/SKILL_DEVELOPMENT_GUIDE.md for detailed instructions.

Contributing

See CONTRIBUTING.md for guidelines.

License

MIT License — see LICENSE for details.

Acknowledgements

The evidence and coverage model in v1.2 was informed by Cloudflare’s MIT-licensed security-audit-skill and adapted to security-check’s multi-skill four-phase pipeline.

Author

Ersin Koc — ECOSTACK TECHNOLOGY OU