Deep Security Check

Use when the user asks for a defensive security assessment, security audit, vulnerability scan, or "how safe / how reliable is this code/project/repo". Runs Semgrep (SAST), osv-scanner (dependency CVEs) and gitleaks (secrets) against a local project, then produces a report with a reproducible reliability grade (0-100, A-F). Defensive only — finds weaknesses in code you own; it does not exploit, attack, or test remote targets.

2 stars 2 forksSecurity

Install

skills CLI (Claude Code, Cursor, Codex and more)

npx skills add give-jd/deep-security-check --skill deep-security-check

Manual install

git clone --depth 1 https://github.com/give-jd/deep-security-check.git /tmp/deep-security-check
mkdir -p ~/.claude/skills
cp -r /tmp/deep-security-check/skills/deep-security-check ~/.claude/skills/deep-security-check

Personal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.

From the SKILL.md

# Deep Security Check

Defensive, read-only security assessment of a local project + a reproducible
reliability grade. Static analysis only — this is not a penetration test and
never touches a live/remote target.

## When to use

- "Is this project secure? / how reliable is it?"
- "Audit this repo for vulnerabilities / secrets / vulnerable dependencies."
- Pre-release or pre-acquisition due-diligence on a codebase you are authorized
  to inspect.

Do **not** use for offensive requests (exploiting, attacking a running host,
credential access). This skill only inspects source you already have.

## Workflow

1. **Scan.** Run the bundled scanner. `$SKILL_DIR` is this skill's directory.
   ```bash
   bash "$SKILL_DIR/scripts/scan.sh" <project-dir>
   ```
   It runs whichever of Semgrep / osv-scanner / gitleaks are installed and writes
   one SARIF per tool. Capture the `OUT=<dir>` line. If it reports a scanner is
   missing, tell the user the one-line install command it printed and continue
   with whatever ran (the score's confidence will reflect the reduced coverage).
   Egress-restricted environments degrade automatically: if the Semgrep registry
   is unreachable it falls back to the bundled MIT ruleset (`rules/offline-basic.yaml`,
   reduced coverage — say so in the report), and if gitleaks is not on PATH on
   Linux x86_64 the vendored binary in `vendor/` is used.
   On git repos, secrets are also scanned in the **git history** (committed-then-

Read the full skill on GitHub

Details

Skill name: deep-security-check
Repository: give-jd/deep-security-check
Path: skills/deep-security-check/SKILL.md
License: MIT
Repo updated: 10 July 2026
Listed in: karanb192/awesome-claude-skills

FAQ

What does the Deep Security Check skill do?

How do I install the Deep Security Check skill?

skills CLI (Claude Code, Cursor, Codex and more): npx skills add give-jd/deep-security-check --skill deep-security-check. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.

Is Deep Security Check popular?

It lives in give-jd/deep-security-check, which has 2 GitHub stars and 2 forks, and is included in 1 curated skill list.

Related skills

Incident Reporting Navigator

Ansvar-Systems/incident-reporting-navigator-skill

Use when a security incident, data breach, or actively exploited vulnerability raises the question "who must we notify, where, and by when?" Screens one incident across the EU reporting regimes — NIS2, GDPR, DORA, and the Cyber Resilience Act — determines which duties fire for each involved entity's roles, resolves the receiving authority per regime and member state from served national law, and produces a deadline table in which every duty, authority, and deadline is cited from official publisher text fetched live through the Ansvar Gateway MCP connector. Never answers from model memory.

SecurityIn 1 list

Deep Security Audit

ravindrakele/claude-skills

Deep, multi-agent security audit of a codebase — WordPress plugin, Laravel, Next.js, Node/Express, Django/Rails, or any app. Detects the framework, maps the REAL attack surface (routes, handlers, auth, sinks), then fans out scoped finder agents that READ and understand the code (not just grep), adversarially verifies every finding (proves the guard is genuinely absent + traces reachability), scores honest CVSS 3.1, dedupes, and produces a ranked report. Use whenever the user asks to find security issues / vulnerabilities, run a security audit or pentest, "is this secure", "scan this plugin/app

SecurityIn 1 list

Regulatory Threat Model

Ansvar-Systems/regulatory-threat-model-skill

Use when an application or system — including one built quickly with AI coding agents — needs a security review with regulatory grounding: a STRIDE threat model, a LINDDUN privacy threat model, a dependency exposure screen against live CVE / CISA-KEV / EPSS data, or a selected, non-exhaustive screen of which EU security obligations (GDPR, NIS2, Cyber Resilience Act, AI Act) may apply and which need determination. Orchestrates the server-enforced threat-modeling workflows of the Ansvar Gateway MCP connector and grounds every regulatory statement in officially published text fetched at answer ti

SecurityIn 1 list

Web Security Reviewer

goingli0324/web-security-reviewer

對使用者自己的程式碼做防禦性安全審查，檢測資安漏洞、資料外洩風險、壓力／效能風險與程式品質，並產出「依嚴重度排序的風險報告＋修正後程式碼」。涵蓋 Google Apps Script（Workspace 自動化）、前端 HTML/CSS/JS、後端 API（Node/Python/PHP 等）。特別適用於「使用者用 AI 生成 / vibe coding 寫出來、希望更安全、避免被攻擊或破壞」的網頁程式碼。MANDATORY TRIGGERS：使用者要求「檢測程式碼安全」「幫我看這段 code 有沒有漏洞」「防止資料外洩」「review 我的網頁／後端程式」「這段會不會被攻擊／被駭」「加固 / harden」「壓力測試」「優化程式碼安全性」「個資會不會外洩」「這是 AI 寫的幫我看安不安全」，或貼上一段前端／後端／Apps Script 程式碼並要求審查、找漏洞、修正建議、加固時，都要套用此 skill。即使使用者沒明說「資安」，只要意圖是審查或加固自己的程式碼，就觸發。SCOPE：本 skill 僅用於防禦性檢測——找出並修補使用者自己程式碼裡的漏洞；不協助撰寫可直接攻擊用的 exploit、不協助繞過資安機制。本 skill 同時是 agentic-dev-loop「Verify 雙閘」的安全閘：當該編排器要在部署前驗證安全／個資時會呼叫本 skill；使用者單獨要求安全審

Security

Awesome Bug Bounty

YangTech-gh/Awesome-Bug-Bounty

Use when doing bug bounty hunting, vulnerability research, security report writing/analysis, payload or WAF-bypass selection, business logic / IDOR / race / API testing, recon methodology, tool choice (Burp vs Caido vs ZAP, AI pentest agents, MCP security testing, headless browsers), or looking up writeups/programs — e.g. "find XSS payload", "business logic checklist", "SSRF bypass", "HackerOne top reports", "bug bounty methodology", "which tools to install". Merges curated knowledge with source-repo fallbacks; authorized testing only.

SecurityIn 1 list

Tenable Sc Reporting Assistant

hamzhk15/tenable-sc-reporting-assistant

Generate importable Tenable Security Center (Tenable SC / SecurityCenter) XML for dashboards, PDF reports, and CSV exports, then optionally upload them to a SC console via API keys. Works two ways — a freeform mode that maps any dashboard/report a user describes to a catalog of known-good components, proposes the layout for approval, and builds it with tested builders; and a curated "Vulnerability Management and Remediation Planning" dashboard/report as a ready-made starting point. Use whenever someone wants to build, customize, or deploy a Tenable SC dashboard or report of any kind — vulnerab

Security

Browse the most popular Claude skills, all security skills, or write your own with the skills generator.