In short:
ak-securityscans for secrets, dependencies with known vulnerabilities and dangerous code patterns, then analyzes threats with STRIDE and OWASP Top 10. The report is ranked by severity, and you hand the rest toak-planor dig into authorization withak-scenario. By default it does not change code, never rewrites git history on its own and does not attack running systems.
Disclosure: I maintain AgentKit and have an affiliate relationship with it: the AgentKit link in this post is an affiliate link; buying through it gets you 30% off.
Summary
Use it when you are about to release, have just added sign-in or payments, or suspect an API key slipped into the code. It also fits right after ak-predict raises a security concern. You do not need it for a real network pentest: the skill does not attack running systems, does not simulate DDoS, and does not cover physical or hardware security.
flowchart LR
A["Before release, or ak-predict flags security"] --> B["ak-security"]
B --> C["Report ranked by severity"]
C --> D["ak-security --fix"]
C --> E["ak-plan: schedule Medium, Low into a sprint"]
C --> F["ak-scenario: dig into authorization flows"]Each run answers 4 questions:
| Point | Question | Example |
|---|---|---|
| Scope | Where to scan? | src/api/ to look at the API layer only. Leave it empty to scan the whole project, minus .git/, node_modules/, dist/, vendor/ |
| Mode | Quick check or deep audit? | --secrets-only for a quick leaked-key check before you push. No flag means a full audit |
| Severity | What to fix first? | Critical blocks the release, High this sprint, Medium next sprint, Low to the backlog, Info is a hint |
| Report-only by default | Does it change my code? | No, unless you add --fix. Secrets are always masked with a label like <REDACTED_AWS_KEY> |
Before it assigns severity, it identifies the assets to protect, who can reach them and where the trust boundaries are. A scary-sounding function name is not a finding on its own; it needs a real exploit path. The most important caveat: removing a secret from code is not the end. A leaked key still works, so rotate it at the provider right away.
Sample prompt for a pre-release audit:
/ak-security
Project <app name> is about to release version <version>.
Report only, do not fix anything yet.| Flag | What it is for | Since ak |
|---|---|---|
--secrets-only | Scans only secrets and credentials | 2.15.0 |
--deps-only | Checks only dependencies with CVEs | 2.15.0 |
--fix | Fixes confirmed findings after the audit | 1.0.0 |
--red-team | Looks through 4 attacker personas in turn | 1.0.0 |
--iterations | Caps the total number of rounds (--iterations N) | 1.0.0 |
Below is the detailed version: the run flow, 5 situations with prompts, each flag explained (when to use it, what you get, which flags it combines with), the change history by ak release, and common pitfalls. The detailed version and the interactive page are for subscribers. Your agent can also search them through the portal's MCP.
Opens when your account has subscriber access
This guide is for subscribers
Once your account has access, the full piece, the interactive visual and the agent call all open.
- Sign in or create a modernEngineer accountReading access belongs to your account email.
- Choose a plan on the pricing page1, 3 or 12 months, paid by VietQR bank transfer. Access opens about a minute after the money arrives.
- Or redeem a Facebook subscriber codePeople supporting the page on Facebook get an activation code by message each month.
Already a subscriber? Sign in to read.
Use this piece in your agent
Get an API keyCopy the text below and paste it into Claude Code, Codex or whichever agent you use. The agent reads the piece and checks it against the repo you have open.
Read "ak-security: scan secrets, dependencies and code vulnerabilities" on modernEngineer and apply it to this repo.
1. Call the content_get tool of the modernengineer MCP server with locale "en", slug "ak-security". If the modernengineer MCP server is not connected, stop and walk me through connecting it from https://modernengineer.dev/en/mcp.
2. Summarize the main steps of the piece and point out which apply to this repo.
3. Propose concrete changes and ask me before editing any file.Connect MCP in Claude Code (once)
claude mcp add --transport http modernengineer \
https://api.modernengineer.dev/mcp \
--header "Authorization: Bearer <API key>"Reading the full piece over MCP needs an API key from a subscriber account or one that bought this guide. Without access, the agent only gets the opening.
- Version
- v1.0.0
- Updated
- 22/10/2026
- Licence
- All rights reserved
- Slug
- ak-security
