Shield Security Orchestrator
Slår samman Semgrep, gitleaks och npm audit till en poängsatt säkerhetsrapport
Testad · Fungerar
Vad den gör
Kapslar in Semgrep SAST, gitleaks secret scanning, package audits och dependency-freshness checks behind a single workflow, then merges every tool's output into one normalised JSON, assigns SHIELD-XXX ids and computes a 0-100 risk score with CWE and OWASP mapping. Utlöses när en användare ber om en security scan, a vulnerability audit, a secrets check or a dependency CVE review before shipping. Full autonomous pentest mode additionally requires Docker och a local clone of the Shannon engine.
Testrapport
Ran the full bundled pipeline live against a deliberately vulnerable Express app: npm audit surfaced 9 vulnerable packages including a CRITICAL minimist prototype-pollution, and gitleaks pulled a Slack bot token out of a commit whose file had already been deleted from HEAD, neither of which is reachable by reading the working tree. The Semgrep layer is noisier: its catch-all NoSQL rule flagged app.listen(3000) as a HIGH CWE-943 injection and fired six times on ordinary Express calls, while the dedicated SQL-injection and path-traversal rules missed the real ones because the query was assigned to a variable first. Consolidation and scoring worked end to end (18 findings, 0/100 CRITICAL), although the false positives alone are enough to bottom out the score. The repo's own 61 unit tests all pass. The outdated checker reports every package as 'unknown' versions behind despite the docs promising major/minor/patch counts, and the plugin copy of SKILL.md points at a ${CLAUDE_SKILL_DIR} variable that does not exist in Claude Code.
Testad: 2026-07-30 · Claude Code 2.x (agent harness)
Installation
git clone https://github.com/alissonlinneker/shield-claude-skill.git mkdir -p ~/.claude/skills/shield cd shield-claude-skill && cp -r SKILL.md scripts templates configs ~/.claude/skills/shield/
Kommandon och exempelprompter
/shieldSlår samman Semgrep, gitleaks och npm audit till en poängsatt säkerhetsrapport
Skills triggas av vanliga förfrågningar — inga kommandon att memorera. Efter installationen aktiverar prompter som dessa skillen (på engelska):
Scan this repo for security vulnerabilities before we deploy to productionCheck if there are any hardcoded secrets or API keys in this codebaseAudit our npm dependencies for known CVEs and give me a risk score