Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
Fix: add minimum version check to scan.sh to catch stale shims from dual pip installs. Update install instructions to recommend pipx/uv tool instead of pip.
What This Skill Does
SecureVibes Scanner runs AI-powered security scans on codebases using Claude. It executes a multi-phase pipeline covering architecture assessment, STRIDE threat modeling, code review, and report generation. Incremental mode tracks the last-scanned commit and only processes new changes, making it usable for continuous monitoring via cron.
Combines architecture assessment, threat modeling, static code review, and optional dynamic testing in one pipeline instead of requiring separate tools for each phase.
When to use it
- Scanning a new codebase before shipping to production
- Running a threat model on a microservice or internal API
- Reviewing recent commits for newly introduced vulnerabilities
- Setting up automated security monitoring on a git repository
- Getting a severity-ranked security report before a pentest or audit
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Scan my repo at /home/user/myapp for security vulnerabilities
- 1Run bash scripts/scan.sh /home/user/myapp --force via the safe wrapper script
- 2Pipeline executes four phases sequentially: assessment, threat modeling, code review, report generation
- 3Wait for all phases to complete (10-30 minutes), then read .securevibes/scan_report.md
- 4Summarize findings by severity (Critical, High, Medium, Low) and highlight top 3 issues with file locations and remediation steps
Security report with finding counts by severity, top critical vulnerabilities with file paths and fix suggestions, and options to run DAST or re-scan after changes
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.