Shield Security Orchestrator
Merges Semgrep, gitleaks and npm audit into one scored security report
Test report
- Verdict
- Tested · Works
- Score
- Tested
- Jul 30, 2026
- Environment
- Claude Code 2.x (agent harness)
- Upstream re-checked
- Jul 30, 2026 · 0fdf5da
⚠ This skill is no longer available upstream. Our re-check on Aug 10, 2026 couldn't find it any more (repo unreachable/deleted). The test below is what we measured on Jul 30, 2026 and we're leaving it up as a record — but there is nothing left to install, so we've removed the command.
Ran the full bundled pipeline live against a deliberately vulnerable Express app: npm audit surfaced 9 vulnerable packages including a CRITICAL minimist prototype-pollution, and gitleaks pulled a Slack bot token out of a commit whose file had already been deleted from HEAD, neither of which is reachable by reading the working tree. The Semgrep layer is noisier: its catch-all NoSQL rule flagged app.listen(3000) as a HIGH CWE-943 injection and fired six times on ordinary Express calls, while the dedicated SQL-injection and path-traversal rules missed the real ones because the query was assigned to a variable first. Consolidation and scoring worked end to end (18 findings, 0/100 CRITICAL), although the false positives alone are enough to bottom out the score. The repo's own 61 unit tests all pass. The outdated checker reports every package as 'unknown' versions behind despite the docs promising major/minor/patch counts, and the plugin copy of SKILL.md points at a ${CLAUDE_SKILL_DIR} variable that does not exist in Claude Code.
Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works
- Installs cleanly 5/5
- Triggers reliably 5/5
- Output vs. baseline 7/10
- Docs & honesty 3/5
What Shield Security Orchestrator does
Wraps Semgrep SAST, gitleaks secret scanning, package audits and dependency-freshness checks behind a single workflow, then merges every tool's output into one normalised JSON, assigns SHIELD-XXX ids and computes a 0-100 risk score with CWE and OWASP mapping. Triggers when a user asks for a security scan, a vulnerability audit, a secrets check or a dependency CVE review before shipping. Full autonomous pentest mode additionally requires Docker and a local clone of the Shannon engine.
How to install Shield Security Orchestrator
Nothing to install: the source repository no longer has this skill. If the author brings it back, our daily re-check will pick it up and the command will reappear here.
Commands — how to trigger Shield Security Orchestrator
-
/shieldMerges Semgrep, gitleaks and npm audit into one scored security report
It also activates on plain-language prompts like these:
-
Scan this repo for security vulnerabilities before we deploy to production -
Check if there are any hardcoded secrets or API keys in this codebase -
Audit our npm dependencies for known CVEs and give me a risk score
Frequently asked questions
- Is the Shield Security Orchestrator skill free?
- Yes. The skill itself is free from alissonlinneker/shield-claude-skill. SkillProof publishes the install command and an independent test verdict at no cost.
- Does Shield Security Orchestrator work with Claude Code?
- We tested it with Claude Code 2.x (agent harness) on Jul 30, 2026. Verdict: Tested · Works. Ran the full bundled pipeline live against a deliberately vulnerable Express app: npm audit surfaced 9 vulnerable packages including a CRITICAL minimist prototype-pollution, and gitleaks pulled a Slack bot token out of a commit whose file had already been deleted from HEAD, neither of which is reachable by reading the working tree. The Semgrep layer is noisier: its catch-all NoSQL rule flagged app.listen(3000) as a HIGH CWE-943 injection and fired six times on ordinary Express calls, while the dedicated SQL-injection and path-traversal rules missed the real ones because the query was assigned to a variable first. Consolidation and scoring worked end to end (18 findings, 0/100 CRITICAL), although the false positives alone are enough to bottom out the score. The repo's own 61 unit tests all pass. The outdated checker reports every package as 'unknown' versions behind despite the docs promising major/minor/patch counts, and the plugin copy of SKILL.md points at a ${CLAUDE_SKILL_DIR} variable that does not exist in Claude Code.
- What is the Shield Security Orchestrator SkillProof Score?
- 8.0/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 7/10, docs & honesty 3/5.
- How do I install Shield Security Orchestrator?
- Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
- Can I use Shield Security Orchestrator with Cursor, Copilot, Gemini CLI, Codex or other AI tools?
- The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.