Getting started with securmyapp

What you need

Everything below is free except the Claude plan. securmyapp's engine has zero dependencies to install — it works the moment you drop the skill folder in place, and if an optional scanner is missing, it simply tells you and carries on.

1 · Install the prerequisites

Node.js (v18 or newer)

Check whether it's already installed — open a terminal and run:

node --version

If it prints v18 or higher, you're set. Otherwise install the LTS build from nodejs.org (Windows/macOS), or use your package manager (brew install node, apt install nodejs npm). Reopen your terminal afterwards.

Claude Code

Claude Code is the tool the skill runs in. Either option works — the skill behaves the same:

npm install -g @anthropic-ai/claude-code

…or install Claude Desktop and use its Code tab (claude.com/download). They share the same configuration, so a skill installed on one side is available on the other.

2 · Install the skill

The repository is the skill (its SKILL.md sits at the root), so installing is a single clone into your Claude Code skills folder — identical in the terminal and in Claude Desktop:

git clone https://github.com/mafady/securmyapp ~/.claude/skills/securmyapp

Restart Claude Code and you're done: there's no marketplace to add, no MCP server to register, and nothing to reload. Claude picks up the skill automatically from its description.

3 · Install the security scanners

Scanners are small, free tools that securmyapp drives to find vulnerabilities.

Semgrep — recommended (code analysis)

# macOS
brew install semgrep

# Linux / Windows (needs Python 3)
pipx install semgrep

semgrep --version

Playwright browser — recommended (regression tests)

After each fix, securmyapp opens a real browser to confirm your app still works. Install the browser once:

npx playwright install chromium

Optional scanners

On Linux/Windows each has its own install page (search “install trivy”, etc.) or installs via pipx / your package manager. Verify what securmyapp detects with node ~/.claude/skills/securmyapp/scripts/scan.mjs doctor.

4 · Verify the installation

Two quick checks:

• Confirm the file is in place: ~/.claude/skills/securmyapp/SKILL.md exists.
• Run the bundled doctor — it lists which scanners were found:

node ~/.claude/skills/securmyapp/scripts/scan.mjs doctor

Then, in your project, ask Claude to “audit my app's security” (or type /securmyapp). If it starts the audit, the skill is picked up. Otherwise, see Troubleshooting.

5 · Run your first audit

1. Make sure Claude Code is open in your project folder.
2. Ideally, have your app running locally (e.g. http://localhost:3000) so regression tests can run. If not, securmyapp asks for the URL once, or audits without the browser part.
3. Ask Claude to audit your app's security — or type the command:

/securmyapp

Then, on its own: scoping (detects your stack + captures a healthy baseline) → autonomous audit (it checks every security domain against the catalog) → report (posture score + findings by risk) → guided remediation (it proposes the first fix and stops for your decision). Nothing is changed without your approval.

6 · Read the report

The report looks like this:

# Report securmyapp — 2026-07-11

Posture: ############--------  64/100

Critical: 0   High: 9   Medium: 6   Low: 1

- High   SQL query built by concatenation   routes.js:4  (CWE-89 | A03:2021)
- High   Outbound request from user input   routes.js:8  (CWE-918)

• Critical Fix first — full compromise possible.
• High Serious — fix quickly.
• Medium Should be fixed.
• Low Improvement / defense in depth.

The posture score /100 rises as you fix. Each line is one finding, with the file and line and the CWE/OWASP reference.

7 · Guided remediation

This is the heart of the tool. For every fix, the flow is always the same and safe:

1. It explains the vulnerability and shows the proposed fix (before / after).
2. It applies the fix, then makes a Git commit — so it's reversible.
3. It re-opens your app in a real browser and checks nothing broke vs. the baseline.
4. It stops and asks you — the checkpoint, with 3 choices: ✅ approve · ❌ reject (roll back) · ✍️ say exactly what to do.
5. It writes a memory note, then moves to the next finding.

Troubleshooting

Claude doesn't use the skill

Confirm the file is at ~/.claude/skills/securmyapp/SKILL.md (the folder must be named securmyapp with SKILL.md directly inside it). Restart Claude Code, then ask explicitly: “use the securmyapp skill to audit my app”. Also make sure Claude Code is up to date:

npm install -g @anthropic-ai/claude-code@latest

node: command not found when a scanner runs

Node.js isn't on your PATH. Install it from nodejs.org (or your package manager) and reopen your terminal. Check with node --version.

“scanner missing” in the report

Not a blocking error — securmyapp continues. Install the relevant scanner (step 3) to enable that part of the analysis. See what's detected with node ~/.claude/skills/securmyapp/scripts/scan.mjs doctor.

Frequently asked questions

Uninstall / update

Update to the latest version — pull inside the skill folder:

cd ~/.claude/skills/securmyapp
git pull

Uninstall — just remove the folder:

rm -rf ~/.claude/skills/securmyapp

On Windows, delete %USERPROFILE%\.claude\skills\securmyapp. To disable without deleting, rename the folder (e.g. add a .off suffix) and restart Claude Code.