Shield Security Orchestrator
Führt Semgrep, gitleaks und npm audit zu einem bewerteten Sicherheitsbericht zusammen
Getestet · Funktioniert
Was es kann
Wraps Semgrep SAST, gitleaks secret scanning, package audits und dependency-freshness checks behind a single workflow, then merges every tool's output into one normalised JSON, assigns SHIELD-XXX ids und computes a 0-100 risk score with CWE and OWASP mapping. Wird ausgelöst, wenn ein user asks for a security scan, a vulnerability audit, a secrets check or a dependency CVE review before shipping. Full autonomous pentest mode additionally requires Docker and a local clone of the Shannon engine.
Testbericht
Ran the full bundled pipeline live against a deliberately vulnerable Express app: npm audit surfaced 9 vulnerable packages including a CRITICAL minimist prototype-pollution, and gitleaks pulled a Slack bot token out of a commit whose file had already been deleted from HEAD, neither of which ist reachable by reading the working tree. Die Semgrep layer ist noisier: its catch-all NoSQL rule flagged app.listen(3000) as a HIGH CWE-943 injection and fired six times on ordinary Express calls, while the dedicated SQL-injection and path-traversal rules missed the real ones because the query war assigned to a variable first. Consolidation and scoring worked end to end (18 findings, 0/100 CRITICAL), although the false positives alone are enough to bottom out the score. Die repo's own 61 unit tests all pass. Der outdated checker reports every package as 'unknown' versions behind despite the docs promising major/minor/patch counts, and the plugin copy of SKILL.md points at a ${CLAUDE_SKILL_DIR} variable that does not exist in Claude Code.
Getestet am: 2026-07-30 · Claude Code 2.x (agent harness)
Installation
git clone https://github.com/alissonlinneker/shield-claude-skill.git mkdir -p ~/.claude/skills/shield cd shield-claude-skill && cp -r SKILL.md scripts templates configs ~/.claude/skills/shield/
Befehle & Beispiel-Prompts
/shieldFührt Semgrep, gitleaks und npm audit zu einem bewerteten Sicherheitsbericht zusammen
Skills reagieren auf normale Anfragen — keine Slash-Befehle nötig. Nach der Installation aktivieren Prompts wie diese den Skill (auf Englisch):
Scan this repo for security vulnerabilities before we deploy to productionCheck if there are any hardcoded secrets or API keys in this codebaseAudit our npm dependencies for known CVEs and give me a risk score