How do I install the Security Scan skill?

Run npx skillmds add majiayu000/security-scan-9 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Security Scan skill do?

Run a comprehensive security scan across all systems It is listed under Security on SkillMD.

Is Security Scan safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Security Scan?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Security Scan free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Security Scan?

majiayu000 (@majiayu000) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Security Scan by majiayu000 — Agent Skill

Name: Security Scan
Rating: 4.666666666666667 (3 reviews)
Author: majiayu000

File contents

You are helping the team run a comprehensive security scan across Jocko Fuel systems.

Follow these steps:

Step 1: Define Scan Scope

Ask the user what to scan. Options:

Full scan: All systems (APIs, infrastructure, SaaS, Snowflake, endpoints)
Domain-specific: Target a specific area (e.g., "just APIs" or "just Snowflake")
Project-specific: Scan a particular project or service

If the user says "everything," delegate to security-orchestrator to coordinate a full scan.

Step 2: Execute Scans

Delegate to the security-orchestrator agent to route scans to specialized agents:

API endpoints → api-security-audit agent
Identity and access → identity-access-reviewer agent
Endpoints and TLS → endpoint-security-auditor agent
Dependencies and code → vulnerability-scanner agent
SaaS platforms → saas-security-auditor agent
Snowflake → snowflake-security-auditor agent
External attack surface → attack-surface-monitor agent

Step 3: Aggregate Findings

Collect results from all agents and categorize by:

Critical: Actively exploitable or data-exposing issues
High: Significant risk requiring prompt remediation
Medium: Notable issues for planned remediation
Low: Minor issues or hardening recommendations
Informational: Best practice suggestions

Step 4: Present Results

Deliver a scan summary with:

Total findings by severity
Top 5 priority items requiring immediate attention
Per-domain breakdown table
Recommended remediation timeline

Error Handling

If a system is unreachable, note it as "not scanned" and recommend manual review
If credentials are insufficient for a scan, inform the user of required access
If scan scope is too broad, suggest breaking into phased scans

---name: security-scan-9description: Run a comprehensive security scan across all systems--- You are helping the team run a comprehensive security scan across Jocko Fuel systems. Follow these steps: ### Step 1: Define Scan Scope Ask the user what to scan. Options: - **Full scan**: All systems (APIs, infrastructure, SaaS, Snowflake, endpoints) - **Domain-specific**: Target a specific area (e.g., "just APIs" or "just Snowflake") - **Project-specific**: Scan a particular project or service If the user says "everything," delegate to `security-orchestrator` to coordinate a full scan. ### Step 2: Execute Scans Delegate to the `security-orchestrator` agent to route scans to specialized agents: - **API endpoints** → `api-security-audit` agent - **Identity and access** → `identity-access-reviewer` agent - **Endpoints and TLS** → `endpoint-security-auditor` agent - **Dependencies and code** → `vulnerability-scanner` agent - **SaaS platforms** → `saas-security-auditor` agent - **Snowflake** → `snowflake-security-auditor` agent - **External attack surface** → `attack-surface-monitor` agent ### Step 3: Aggregate Findings Collect results from all agents and categorize by: - **Critical**: Actively exploitable or data-exposing issues - **High**: Significant risk requiring prompt remediation - **Medium**: Notable issues for planned remediation - **Low**: Minor issues or hardening recommendations - **Informational**: Best practice suggestions ### Step 4: Present Results Deliver a scan summary with: - Total findings by severity - Top 5 priority items requiring immediate attention - Per-domain breakdown table - Recommended remediation timeline ### Error Handling - If a system is unreachable, note it as "not scanned" and recommend manual review - If credentials are insufficient for a scan, inform the user of required access - If scan scope is too broad, suggest breaking into phased scans

Frequently asked questions