From kusari
Run a Kusari security scan on the current repository. Scans code and dependencies against a git revision, presenting health score, code mitigations, and dependency mitigations. Use when the user asks for a security scan, vulnerability check, or wants to evaluate code changes for security issues.
How this skill is triggered — by the user, by Claude, or both
Slash command
/kusari:change-evaluateThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
You run a Kusari security scan on the current repository and present findings to the developer.
You run a Kusari security scan on the current repository and present findings to the developer.
$ARGUMENTS
Optional git revision to compare against (e.g., main, HEAD~5, abc1234).
If empty, defaults to the repository's default branch.
Change to the repository root before running any scripts:
cd "$(git rev-parse --show-toplevel)"
If $ARGUMENTS is provided and non-empty, use it as the revision.
Otherwise, detect the default branch:
source <skill_dir>/scripts/common.sh
REVISION=$(detect_default_branch)
Call the mcp__kusari-inspector__scan_local_changes tool with:
repo_path: the repository root path (output of git rev-parse --show-toplevel)base_ref: the revision from step 2output_format: "sarif"If the MCP tool is unavailable (tool not found, connection refused, or unreachable):
If the MCP tool returns a scan-level error (authentication failure, invalid repository, server-side error):
If the MCP tool succeeds and returns SARIF output:
Write the SARIF JSON response to a temporary file.
Parse the results using the existing pipeline:
export KUSARI_GIT_REVISION="<revision>"
source <skill_dir>/scripts/parse-sarif.sh
SARIF_TMP=$(mktemp "${TMPDIR:-/tmp}/kusari-mcp-sarif-XXXXXX.json")
cat > "$SARIF_TMP" <<'SARIF_EOF'
<paste the SARIF JSON response here>
SARIF_EOF
scan_json=$(parse_scan_result "$SARIF_TMP")
code_mits_json=$(extract_code_mitigations "$SARIF_TMP")
dep_mits_json=$(extract_dependency_mitigations "$SARIF_TMP")
rm -f "$SARIF_TMP"
echo "$scan_json"
echo "$code_mits_json"
echo "$dep_mits_json"
Set scan_method to "mcp".
Skip step 4 and proceed to step 5.
Only reached if the MCP tool was unavailable:
bash <skill_dir>/scripts/scan.sh $ARGUMENTS
Handle exit codes:
If the CLI also fails with exit code 1 (kusari CLI not installed) AND the MCP tool was also unavailable:
kusari-inspector MCP server in your Claude Code settings."kusari auth login. See https://github.com/kusaridev/kusari-cli."On success, the script outputs a JSON object to stdout with: scan, code_mitigations, dependency_mitigations, revision.
scan_method to "cli".Check for failed_analysis in the scan object. If true, report that the Kusari Inspector encountered an error analyzing the code and suggest retrying.
/kusari.change.fix if there are code mitigations to applyProvides CDSS development patterns for drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), and alert classification integrated into EMR workflows.
npx claudepluginhub kusaridev/kusari-skills --plugin kusari