Is the Secscan skill free?

Yes. The skill itself is free from atgreen/secscan-skill. SkillProof publishes the install command and an independent test verdict at no cost.

What is the Secscan SkillProof Score?

9.2/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 8/10, docs & honesty 5/5.

How do I install Secscan?

Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.

Can I use Secscan with Cursor, Copilot, Gemini CLI, Codex or other AI tools?

The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.

Secscan

In-session LLM SAST triage with adversarial verify and schema-checked findings

by atgreen · atgreen/secscan-skill

Tested · Works

Install — copy the command Download source ↗

Test report

Verdict: Tested · Works
Score: 9.2/10
Tested: Jul 17, 2026
Environment: Claude Code 2.x (agent harness)
Upstream re-checked: Aug 10, 2026 · 1df61ec

Ran it against a planted Node target: it confirmed the string-concatenated SQLi at app.js:11 with a source-to-sink file:line trace and correctly killed the parameterized /search query as a false positive, which a plain grep-for-SQL baseline flags. The bundled zero-dependency validate-findings.cjs is real: it rejected a findings.json with the wrong field types and passed the corrected one. Note the README advertises a private ssh://cave@moxielogic.com clone URL that fails for a first-time user; the working command is the public GitHub clone above.

Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works

Installs cleanly 5/5
Triggers reliably 5/5
Output vs. baseline 8/10
Docs & honesty 5/5

What Secscan does

Runs a staged security scan (survey, threat-model, deep-dive, adversarial verify, report) entirely inside a Claude Code session using Read/Grep/Glob, no external scanner. Triggers on "security scan", "find vulnerabilities", "SAST", "audit this code for security", or "secscan". Emits severity-ranked findings with CVSS/CWE and an optional schema-validated findings.json.

How to install Secscan

git clone https://github.com/atgreen/secscan-skill.git
mkdir -p ~/.claude/skills
cd secscan-skill && cp -r . ~/.claude/skills/secscan

Skills live in ~/.claude/skills/ (global) or .claude/skills/ (per-project). Restart Claude Code after installing.

Commands — how to trigger Secscan

/secscan In-session LLM SAST triage with adversarial verify and schema-checked findings

It also activates on plain-language prompts like these:

scan this Express app for SQL injection and hardcoded secrets
audit my repo for vulnerabilities and give me a findings.json
run a SAST triage on src/ before I ship this feature

Frequently asked questions

Is the Secscan skill free?: Yes. The skill itself is free from atgreen/secscan-skill. SkillProof publishes the install command and an independent test verdict at no cost.
Does Secscan work with Claude Code?: We tested it with Claude Code 2.x (agent harness) on Jul 17, 2026. Verdict: Tested · Works. Ran it against a planted Node target: it confirmed the string-concatenated SQLi at app.js:11 with a source-to-sink file:line trace and correctly killed the parameterized /search query as a false positive, which a plain grep-for-SQL baseline flags. The bundled zero-dependency validate-findings.cjs is real: it rejected a findings.json with the wrong field types and passed the corrected one. Note the README advertises a private ssh://cave@moxielogic.com clone URL that fails for a first-time user; the working command is the public GitHub clone above.
What is the Secscan SkillProof Score?: 9.2/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 8/10, docs & honesty 5/5.
How do I install Secscan?: Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
Can I use Secscan with Cursor, Copilot, Gemini CLI, Codex or other AI tools?: The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.