Is it compatible with multiple programming languages?

Yes, it supports various ecosystems including Node.js, Python, and Rust, and provides multi-language support for static analysis via Semgrep.

When is the best time to run this security audit?

It is highly recommended for use during PR reviews, before merging significant changes, or as a final audit step before deploying to production environments.

Does it detect hardcoded API keys?

Yes, it includes a built-in secret detection engine that scans for API keys, tokens, passwords, and exposed .env files using sophisticated regex patterns.

Can this skill automatically fix security issues?

Yes, by using the --fix flag, the skill can attempt to auto-patch safe vulnerabilities, such as performing patch updates for compromised dependencies.

What tools does the Ralph Security Audit use?

It integrates several leading security tools including Semgrep for SAST, Trivy for container scanning, npm/pip/cargo-audit for dependencies, and custom regex-based secret detection.

Ralph Security Audit

Name: Ralph Security Audit
Author: kimhons

bykimhons

•

安全与测试

Performs automated, multi-layered security scanning across dependencies, source code, and containers to identify vulnerabilities and secret leaks.

Ralph Security Audit is a specialized security intelligence tool for Claude Code that automates comprehensive vulnerability assessments. By integrating industry-standard scanners like Semgrep, Trivy, and npm-audit, it provides a centralized security review before deployment or during PR reviews. It goes beyond simple linting by detecting hardcoded secrets, analyzing container configurations, auditing licenses, and checking for OWASP Top 10 patterns, ensuring production-grade code safety with actionable severity levels and automated remediation options.

主要功能

01Automated secret detection for API keys, tokens, and hardcoded credentials

02Multi-language dependency vulnerability scanning for Node.js, Python, and Rust

03Container image and filesystem scanning using Trivy

04Compliance-focused license auditing to identify risky copyleft licenses

051 GitHub stars

06Static Application Security Testing (SAST) using Semgrep with auto-config rules

使用场景

01Automated security reviews during the Pull Request (PR) process

02Pre-deployment security hardening of production-level applications

03Scanning codebases for accidentally committed secrets or exposed environment files

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add kimhons/ralph-loop-ultra ralph-security-audit

For use in Claude.ai and ChatGPT

Download Skill