Shield Security Orchestrator
Unifica Semgrep, gitleaks e npm audit in un unico rapporto di sicurezza con punteggio
Promosso
Cosa fa
Avvolge Semgrep SAST, gitleaks secret scanning, package audits e dependency-freshness checks behind a single workflow, then merges every tool's output into one normalised JSON, assigns SHIELD-XXX ids e computes a 0-100 risk score with CWE and OWASP mapping. Si attiva quando un user asks for a security scan, a vulnerability audit, a secrets check o a dependency CVE review before shipping. Full autonomous pentest mode additionally requires Docker and a local clone of the Shannon engine.
Rapporto di test
Ho eseguito l'intera bundled pipeline live against a deliberately vulnerable Express app: npm audit surfaced 9 vulnerable packages including a CRITICAL minimist prototype-pollution, e gitleaks pulled a Slack bot token out of a commit whose file had already been deleted from HEAD, neither of which is reachable by reading the working tree. The Semgrep layer is noisier: its catch-all NoSQL rule flagged app.listen(3000) as a HIGH CWE-943 injection and fired six times on ordinary Express calls, while the dedicated SQL-injection and path-traversal rules missed the real ones because the query was assigned to a variable first. Consolidation and scoring worked end to end (18 findings, 0/100 CRITICAL), although the false positives alone are enough to bottom out the score. The repo's own 61 unit tests all pass. The outdated checker reports every package as 'unknown' versions behind despite the docs promising major/minor/patch counts, and the plugin copy of SKILL.md points at a ${CLAUDE_SKILL_DIR} variable that does not exist in Claude Code.
Testato il: 2026-07-30 · Claude Code 2.x (agent harness)
Installazione
git clone https://github.com/alissonlinneker/shield-claude-skill.git mkdir -p ~/.claude/skills/shield cd shield-claude-skill && cp -r SKILL.md scripts templates configs ~/.claude/skills/shield/
Comandi e prompt di esempio
/shieldUnifica Semgrep, gitleaks e npm audit in un unico rapporto di sicurezza con punteggio
Gli skill si attivano con richieste in linguaggio naturale, senza comandi da ricordare. Dopo l'installazione, prompt come questi lo attivano (in inglese):
Scan this repo for security vulnerabilities before we deploy to productionCheck if there are any hardcoded secrets or API keys in this codebaseAudit our npm dependencies for known CVEs and give me a risk score