Our review
Scans project dependencies for known vulnerabilities (CVEs) using Claude Flow CLI and npm audit, then triages findings by severity.
Strengths
- Combines Claude Flow CLI and npm audit for broad npm-project coverage
- Provides clear severity levels with concrete recommended actions
- Supports auto-fix of vulnerable packages and continuous monitoring via MCP hook
- Simple one-command invocation for quick checks
Limitations
- Primarily targets Node.js/npm projects; other ecosystems are not covered
- Auto-fix may not resolve all vulnerability classes without manual intervention
- Continuous monitoring requires MCP environment configuration
Use when you need to quickly identify known vulnerabilities in a Node.js project's dependencies before release or after dependency updates.
Avoid for non-npm ecosystems or when you need deep manual vulnerability analysis and remediation planning.
Security analysis
CautionThe skill uses npm audit and npx to run security scanning and auto-fixing commands, which are legitimate but execute external code and can modify files. No data exfiltration or destructive actions are apparent, but caution is warranted due to dynamic code execution.
- •Calls external npm packages via npx at latest version, which could potentially be compromised
- •Auto-fix command modifies project files automatically without review
Examples
Run a dependency check and show me the CVEs with severity levels.Use dependency-check to audit dependencies and auto-fix any fixable vulnerabilities.Set up continuous dependency monitoring by dispatching the audit hook for my project.name: dependency-check description: Scan project dependencies for known vulnerabilities and CVEs argument-hint: "[--path PATH]" allowed-tools: Bash(npx * npm *) mcp__claude-flow__memory_store Read
Check dependencies for CVEs and outdated packages:
npx @claude-flow/cli@latest security cve --check
npx @claude-flow/cli@latest security audit --include-dev
npm audit --json
| Severity | Action | |----------|--------| | critical | Block deployment, fix immediately | | high | Fix before next release | | moderate | Schedule fix within sprint | | low | Track in backlog |
Auto-fix: npx @claude-flow/cli@latest security cve --fix
For continuous monitoring, dispatch via MCP:
mcp__claude-flow__hooks_worker-dispatch({ trigger: "audit" })
Security Audit Scanner
Security
Analyzes code to detect OWASP Top 10 vulnerabilities.
OWASP Security Checklist
Security
Generates application security checklists based on the OWASP Top 10.
Threat Model Generator
Security
Generates threat model documents with STRIDE analysis.