SkillProof tested Claude skills

Shield Security Orchestrator

Slučuje Semgrep, gitleaks a npm audit do jedné bodované bezpečnostní zprávy

od alissonlinneker · alissonlinneker/shield-claude-skill

Otestováno · Funguje ★ 8.0/10

Shield Security Orchestrator — Slučuje Semgrep, gitleaks a npm audit do jedné bodované bezpečnostní zprávy

Co umí

Zabaluje Semgrep SAST, gitleaks secret scanning, package audits and dependency-freshness checks behind a single workflow, then merges every tool's output into one normalised JSON, assigns SHIELD-XXX ids and computes a 0-100 risk score with CWE and OWASP mapping. Spouští se, když uživatel požádá o security scan, a vulnerability audit, a secrets check or a dependency CVE review before shipping. Plný autonomous pentest mode additionally requires Docker and a local clone of the Shannon engine.

Testovací report

Spustil jsem celou přibalenou pipeline live against a deliberately vulnerable Express app: npm audit surfaced 9 vulnerable packages including a CRITICAL minimist prototype-pollution, and gitleaks pulled a Slack bot token out of a commit whose file had already been deleted from HEAD, neither of which is reachable by reading the working tree. The Semgrep layer is noisier: its catch-all NoSQL rule flagged app.listen(3000) as a HIGH CWE-943 injection and fired six times on ordinary Express calls, while the dedicated SQL-injection and path-traversal rules missed the real ones because the query was assigned to a variable first. Consolidation and scoring worked end to end (18 findings, 0/100 CRITICAL), although the false positives alone are enough to bottom out the score. The repo's own 61 unit tests all pass. The outdated checker reports every package as 'unknown' versions behind despite the docs promising major/minor/patch counts, and the plugin copy of SKILL.md points at a ${CLAUDE_SKILL_DIR} variable that does not exist in Claude Code.

Testováno: 2026-07-30 · Claude Code 2.x (agent harness)

Instalace

git clone https://github.com/alissonlinneker/shield-claude-skill.git
mkdir -p ~/.claude/skills/shield
cd shield-claude-skill && cp -r SKILL.md scripts templates configs ~/.claude/skills/shield/

Příkazy a ukázkové prompty

  • /shieldSlučuje Semgrep, gitleaks a npm audit do jedné bodované bezpečnostní zprávy

Skilly se spouštějí běžnými požadavky — žádné příkazy k zapamatování. Po instalaci ho aktivují prompty jako tyto (anglicky):

  • Scan this repo for security vulnerabilities before we deploy to production
  • Check if there are any hardcoded secrets or API keys in this codebase
  • Audit our npm dependencies for known CVEs and give me a risk score

Kompletní testovací report (anglicky) →