Security Scan

Analyze code changes (commits, PRs, diffs) using LLM-powered reasoning to detect security vulnerabilities. This skill reads code directly and applies patterns from the repository's threat model to identify issues across all STRIDE categories.

Adapted from Factory AI security-engineer plugin.

When to Use This Skill

• PR review - Automated security scan on pull requests
• Pre-commit check - Scan staged changes before committing
• Branch comparison - Review security of feature branch changes
• After /flux:work - Verify task implementation is secure
• Code review assistance - Help reviewers spot security issues

Prerequisites

1. Threat model - .flux/threat-model.md must exist
2. Security config - .flux/security-config.json for severity thresholds