security-check
Your AI Becomes a Security Team. Every Language. Every Layer. Zero Tools.
Entry points (v1.31.0+):
/security-review — Anthropic native komut (Claude Code 2.1.140+, AI semantic)badi security baseline — deterministic baseline (secret-scan + audit)badi security triage — /security-review rapor severity filtreleme- Bu skill:
sc-orchestrator 4-fazli pipeline (Recon → Hunt → Verify → Report)
What This Skill Does
security-check transforms your AI coding assistant into a comprehensive security scanning team.
It runs a 4-phase pipeline — Recon → Hunt → Verify → Report — entirely through natural language.
No binaries, no dependencies, no CI pipeline changes.
Quick Start
After installation, open your AI assistant and say:
- "run security check" — Full security audit
- "scan diff" — PR/diff-level incremental scan
- "scan for vulnerabilities" — Same as full scan
What's Included
48 Security Skills
| Category |
Count |
Skills |
| Core Pipeline |
6 |
Orchestrator, Recon, Dependency Audit, Verifier, Report, Diff Report |
| Injection |
9 |
SQLi, NoSQLi, GraphQL, XSS, SSTI, XXE, LDAP, CMDi, Header Injection |
| Code Execution |
2 |
RCE, Deserialization |
| Access Control |
4 |
Auth, AuthZ, Privilege Escalation, Session |
| Data Exposure |
3 |
Secrets, Data Exposure, Crypto |
| Server-Side |
4 |
SSRF, Path Traversal, File Upload, Open Redirect |
| Client-Side |
4 |
CSRF, CORS, Clickjacking, WebSocket |
| Logic & Design |
3 |
Business Logic, Race Conditions, Mass Assignment |
| API Security |
3 |
API Security, Rate Limiting, JWT |
| Infrastructure |
3 |
IaC, Docker, CI/CD |
| Language Scanners |
7 |
Go, TypeScript, Python, PHP, Rust, Java, C# |
10 Security Checklists (3000+ items)
Each language scanner includes a 400+ item checklist with specific CWE references.
4-Phase Pipeline
Phase 1: RECON → Architecture mapping, tech stack detection
Phase 2: HUNT → 40+ vulnerability skills run in parallel
Phase 3: VERIFY → False positive elimination, confidence scoring
Phase 4: REPORT → CVSS severity, remediation roadmap
Output
After scanning, a security-report/ directory is created containing:
SECURITY-REPORT.md — Final consolidated reportarchitecture.md — Codebase architecture mapdependency-audit.md — Supply chain analysisverified-findings.md — Findings after false positive elimination
More Information
Source: fatihkan/badi — distributed by TomeVault.
1---2name: security-check3description: Comprehensive AI-powered security scanning suite with 48 skills covering OWASP Top 10, 7 language-specific deep scanners (Go, TypeScript, Python, PHP, Rust, Java, C#), supply chain analysis, infrastructure-as-code scanning, and 3000+ checklist items. Use when you need to run a security audit, find vulnerabilities, scan a PR for security issues, or perform a penetration test on a codebase. Use when this capability is needed.4---56# security-check78> Your AI Becomes a Security Team. Every Language. Every Layer. Zero Tools.910> **Entry points (v1.31.0+)**:11> - `/security-review` — Anthropic native komut (Claude Code 2.1.140+, AI semantic)12> - `badi security baseline` — deterministic baseline (secret-scan + audit)13> - `badi security triage` — /security-review rapor severity filtreleme14> - Bu skill: `sc-orchestrator` 4-fazli pipeline (Recon → Hunt → Verify → Report)1516## What This Skill Does1718security-check transforms your AI coding assistant into a comprehensive security scanning team.19It runs a 4-phase pipeline — **Recon → Hunt → Verify → Report** — entirely through natural language.20No binaries, no dependencies, no CI pipeline changes.2122## Quick Start2324After installation, open your AI assistant and say:2526- **"run security check"** — Full security audit27- **"scan diff"** — PR/diff-level incremental scan28- **"scan for vulnerabilities"** — Same as full scan2930## What's Included3132### 48 Security Skills3334| Category | Count | Skills |35|----------|-------|--------|36| Core Pipeline | 6 | Orchestrator, Recon, Dependency Audit, Verifier, Report, Diff Report |37| Injection | 9 | SQLi, NoSQLi, GraphQL, XSS, SSTI, XXE, LDAP, CMDi, Header Injection |38| Code Execution | 2 | RCE, Deserialization |39| Access Control | 4 | Auth, AuthZ, Privilege Escalation, Session |40| Data Exposure | 3 | Secrets, Data Exposure, Crypto |41| Server-Side | 4 | SSRF, Path Traversal, File Upload, Open Redirect |42| Client-Side | 4 | CSRF, CORS, Clickjacking, WebSocket |43| Logic & Design | 3 | Business Logic, Race Conditions, Mass Assignment |44| API Security | 3 | API Security, Rate Limiting, JWT |45| Infrastructure | 3 | IaC, Docker, CI/CD |46| Language Scanners | 7 | Go, TypeScript, Python, PHP, Rust, Java, C# |4748### 10 Security Checklists (3000+ items)4950Each language scanner includes a 400+ item checklist with specific CWE references.5152### 4-Phase Pipeline5354```55Phase 1: RECON → Architecture mapping, tech stack detection56Phase 2: HUNT → 40+ vulnerability skills run in parallel57Phase 3: VERIFY → False positive elimination, confidence scoring58Phase 4: REPORT → CVSS severity, remediation roadmap59```6061## Output6263After scanning, a `security-report/` directory is created containing:6465- `SECURITY-REPORT.md` — Final consolidated report66- `architecture.md` — Codebase architecture map67- `dependency-audit.md` — Supply chain analysis68- `verified-findings.md` — Findings after false positive elimination6970## More Information7172- [Badi GitHub](https://github.com/fatihkan/badi)7374---75> Source: [fatihkan/badi](https://github.com/fatihkan/badi) — distributed by [TomeVault](https://tomevault.io).76<!-- tomevault:4.0:skill_md:2026-05-22 -->
tomevault-io