# AI use cases for Myrqen (stijnswapped/Myrqen) Repo: [stijnswapped/Myrqen](https://github.com/stijnswapped/Myrqen) | Use cases: 3 | Page: https://dedupedai.com/use-cases/stijnswapped-myrqen/ Myrqen is a source-available TypeScript security scanner that finds candidate vulnerabilities in code and has your coding agent test them against your locally running app. This file holds every use case of this repo. Each one starts with a "## " heading and ends with its URL. - Confirm security candidates in a local app: https://dedupedai.com/use-cases/stijnswapped-myrqen/verify-local-app-security-candidates/ - Read the agent instructions before running them: https://dedupedai.com/use-cases/stijnswapped-myrqen/audit-agent-skill-before-running/ - Measure the scanner's accuracy on its corpus: https://dedupedai.com/use-cases/stijnswapped-myrqen/measure-scanner-accuracy-on-corpus/ ## How to confirm security candidates in a local app with Myrqen Repo: [stijnswapped/Myrqen](https://github.com/stijnswapped/Myrqen) | Difficulty: Intermediate | Time: 15 minutes | Basis: From the README Static analysis flags candidates, then your agent tests the running app and marks each one verified, refuted, or needs_review. **Who it is for:** A developer with a TypeScript, JavaScript, or Python web app on their machine who wants a security check before shipping. **The problem:** Static scanners flag code that may be vulnerable but cannot show whether the running app actually behaves that way, so results are hard to trust. **The outcome:** A report that separates observed vulnerabilities from unconfirmed candidates, with evidence attached to every verified finding. ### Steps 1. Run `npx myrqen link` once to install the Agent Skill for your coding agent. 2. Open a terminal in your project folder and start the application locally. 3. Run `myrqen auto --sync no` to keep the entire scan on your machine. 4. Let the agent exercise the running app, then review the report for verified, refuted, and needs_review findings. ### Prompt to paste into your agent ```text Using the Myrqen repository (stijnswapped/Myrqen) Agent Skill, run `myrqen auto --sync no` in against the app running at . Expect an HTML, Markdown, JSON, or SARIF report listing each finding as verified, refuted, or needs_review. Verify that every verified finding includes the evidence the agent observed. ``` ### Caveat Myrqen will not tell you that you are secure, and any candidate nobody exercises stays needs_review. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/stijnswapped-myrqen/verify-local-app-security-candidates/ ## How to read the agent instructions before running them with Myrqen Repo: [stijnswapped/Myrqen](https://github.com/stijnswapped/Myrqen) | Difficulty: Intermediate | Time: 15 minutes | Basis: From the README Review the plain Markdown Agent Skill and its reference documents before your coding agent acts on them. **Who it is for:** A security-minded developer or team lead who must approve which instructions an AI coding agent follows on company code. **The problem:** An installed agent skill tells the agent what to do, and that instruction set is hard to trust without reading it first. **The outcome:** A reviewed set of Myrqen instructions, including its methodology, safety boundaries, and CLI usage, approved or rejected before any scan runs. ### Steps 1. Run `npx myrqen link` to install the Agent Skill, or clone the Myrqen repository to read the source first. 2. Open `SKILL.md` in packages/skill/myrqen in the Myrqen repository. 3. Read the reference documents in the same folder on methodology, safety boundaries, the finding contract, and the CLI. 4. Approve the scan only if the stated boundaries match your authorization policy. ### Prompt to paste into your agent ```text Read `SKILL.md` and the reference documents in packages/skill/myrqen of the Myrqen repository (stijnswapped/Myrqen). Summarize the safety boundaries and the finding states, and list any instruction that would let the agent act outside a local app. Expect a short written review; verify that the summary cites the file each claim came from. ``` ### Caveat The README says the skill is plain Markdown, so reading it shows what the agent is told, not how the agent behaves in practice. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/stijnswapped-myrqen/audit-agent-skill-before-running/ ## How to measure the scanner's accuracy on its corpus with Myrqen Repo: [stijnswapped/Myrqen](https://github.com/stijnswapped/Myrqen) | Difficulty: Intermediate | Time: 30 minutes | Basis: From the README Run the published benchmark to get recall, precision, and false-positive results for the static pass. **Who it is for:** A tool evaluator or contributor who needs measured detection results instead of numbers copied from a README. **The problem:** Detection claims for a security scanner are hard to judge without knowing how the scanner performs on known vulnerable and safe code. **The outcome:** Recall, precision, per-class results, and the safe-case false-positive rate, compared against the committed baseline. ### Steps 1. Install Node.js 22 or newer and pnpm, then clone the Myrqen repository. 2. Run `pnpm install` in the repository root. 3. Run `pnpm build`, then run `pnpm benchmark` for the full fixture benchmark. 4. Compare the output with benchmark/baseline.json and benchmark/corpus-baseline.json. ### Prompt to paste into your agent ```text In the stijnswapped/Myrqen repository, run `pnpm benchmark` and report recall, precision, and the safe-case false-positive rate. Expect a non-zero exit if results fall below the release gates or regress from benchmark/baseline.json. Verify that the reported numbers match the committed baseline files. ``` ### Caveat The benchmark covers only the listed frameworks and cases in the corpus, so results do not show accuracy on every codebase. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/stijnswapped-myrqen/measure-scanner-accuracy-on-corpus/