Run AI-powered application security scans on codebases. Use when asked to scan code for security vulnerabilities, generate threat models, review code for security issues, run incremental security scans, or set up continuous security monitoring via cron. Supports full scans (one-shot) and incremental scans (cron-driven, only new commits).
Follow the repository instructions for this skill and your agent. Review the files and dependencies before adding it to your workflow.
SkillHub CLI
skillhub install anshumanbh/securevibes-scannerInspect the source and compatibility requirements, then follow its installation steps.
Give your agent the source link and ask it to inspect instructions and dependencies before explaining the installation steps.
AI-native security platform that detects vulnerabilities using Claude AI. Multi-subagent pipeline: assessment → threat modeling → code review → report generation → optional DAST. Supports incremental scanning for continuous monitoring.
pipx install securevibes (preferred) or uv tool install securevibes. Avoid pip install — it can create stale shims if you have multiple Python environments.ANTHROPIC_API_KEY unset or blank — the SDK handles auth.export ANTHROPIC_API_KEY=your-key-here (from console.anthropic.com)scripts/scan.sh wrapper for full scans — it validates paths and rejects shell metacharacters before invoking securevibes.realpath to resolve paths safely and rejects any path containing ;, |, &, $, backticks, or other metacharacters.--target-url you provide. Only use against apps you own or have permission to test.Full scans take 10-30 minutes across 4 phases. Run them as background jobs (cron or subagent), not inline.
Incremental scans take 2-10 minutes — they only scan commits since the last run.
bash scripts/scan.sh /path/to/repo --force --debug
/path/to/repo/.securevibes/
These signals come from indexed source analysis and may lag behind changes. Check the current source files.
# SecureVibes Scanner AI-native security platform that detects vulnerabilities using Claude AI. Multi-subagent pipeline: assessment → threat modeling → code review → report generation → optional DAST. Supports incremental scanning for continuous monitoring. ## Prerequisites 1. Install the CLI: `pipx install securevibes` (preferred) or `uv tool install securevibes`. Avoid `pip install` — it can create stale shims if you have multiple Python environments. 2. Authenticate with Anthropic (one of): - **Max/Pro subscription (recommended):** If you're authenticated via Claude Code or Claude CLI OAuth, no API key is needed. The Claude Agent SDK picks up your OAuth session automatically. When running inside OpenClaw, leave `ANTHROPIC_API_KEY` unset or blank — the SDK handles auth. - **API key:** `export ANTHROPIC_API_KEY=your-key-here` (from console.anthropic.com) ## Security Notes - Always use the `scripts/scan.sh` wrapper for full scans — it validates paths and rejects shell metacharacters before invoking `securevibes`. - **Never interpolate unsanitized user input into shell commands.** - The wrapper uses `realpath` to resolve paths safely and rejects any path containing `;`, `|`, `&`, `$`, backticks, or other metacharacters. - **Scan targets must be local directories.** Clone remote repos to a known safe location first, then pass the resolved path to the wrapper. - **DAST scans make network requests** to the `--target-url` you provide. Only use against apps you own or have permission to test. ## Execution Model **Full scans take 10-30 minutes across 4 phases.** Run them as background jobs (cron or subagent), not inline. **Incremental scans take 2-10 minutes** — they only scan commits since the last run. ## Full Scan (One-Shot) ### Running a Scan 1. Clone the target repo to a local directory 2. Run the wrapper script: `bash scripts/scan.sh /path/to/repo --force --debug` 3. Results appear in `/path/to/repo/.securevibes/` ### Background Execution (Recommend...
Bambu Lab 3D printer control and automation. Activate when user mentions: printer status, 3D printing, slice, analyze model, generate 3D, AMS filament, print monitor, Bambu Lab, or any 3D printing task. Full pi...
Generative Engine Optimization (GEO) for AI search visibility. Optimize content to appear in ChatGPT, Perplexity, Claude, and Google AI Overviews. Use when optimizing websites, pages, or content for LLM discove...
Agents can sign plugins, rotate credentials without losing identity, and publicly attest to behavior.
Send and receive P2P messages using disposable numbers and PINs. No servers, no accounts. Use for human notifications, approval flows, and agent-to-agent communication.