Shield Security Orchestrator
Fletter Semgrep, gitleaks og npm audit ind i én scoret sikkerhedsrapport
Testet · Virker
Hvad det gør
Indkapsler Semgrep SAST, gitleaks secret scanning, package audits og dependency-freshness checks behind a single workflow, then merges every tool's output into one normalised JSON, assigns SHIELD-XXX ids and computes a 0-100 risk score with CWE and OWASP mapping. Udløses når en user asks for a security scan, a vulnerability audit, a secrets check or a dependency CVE review before shipping. Fuld autonomous pentest mode additionally requires Docker and a local clone of the Shannon engine.
Testrapport
Ran the full bundled pipeline live against a deliberately vulnerable Express app: npm audit surfaced 9 vulnerable packages including a CRITICAL minimist prototype-pollution, and gitleaks pulled a Slack bot token out of a commit whose file had already been deleted from HEAD, neither of which is reachable by reading the working tree. The Semgrep layer is noisier: its catch-all NoSQL rule flagged app.listen(3000) as a HIGH CWE-943 injection and fired six times on ordinary Express calls, while the dedicated SQL-injection and path-traversal rules missed the real ones because the query was assigned to a variable first. Consolidation and scoring worked end to end (18 findings, 0/100 CRITICAL), although the false positives alone are enough to bottom out the score. The repo's own 61 unit tests all pass. The outdated checker reports every package as 'unknown' versions behind despite the docs promising major/minor/patch counts, and the plugin copy of SKILL.md points at a ${CLAUDE_SKILL_DIR} variable that does not exist in Claude Code.
Testet: 2026-07-30 · Claude Code 2.x (agent harness)
Installation
git clone https://github.com/alissonlinneker/shield-claude-skill.git mkdir -p ~/.claude/skills/shield cd shield-claude-skill && cp -r SKILL.md scripts templates configs ~/.claude/skills/shield/
Kommandoer og eksempelprompter
/shieldFletter Semgrep, gitleaks og npm audit ind i én scoret sikkerhedsrapport
Skills udløses af almindelige forespørgsler — ingen kommandoer at huske. Efter installationen aktiverer prompter som disse skillen (på engelsk):
Scan this repo for security vulnerabilities before we deploy to productionCheck if there are any hardcoded secrets or API keys in this codebaseAudit our npm dependencies for known CVEs and give me a risk score