cdmx-in/security-review
Security testingこのページは AI により自動翻訳されています。技術的な詳細は原文をご確認ください。 原文を見る
Claude Code skill that runs real security scanners (Semgrep, gitleaks, TruffleHog, Trivy, osv-scanner, ZAP) then verifies every finding against source.
概要
Built and maintained by Codemax IT Solutions Pvt. Ltd. Claude Code already ships /security-review, and it is good at what it does — an LLM reads the diff on your branch and reasons about it. What it does not do is execute a scanner. It cannot walk your git history for a key you committed eight months ago, it does not know a transitive dependency has a published CVE, and it never touches a running app. The tools that do execute scanners are single-domain. The Semgrep plugin runs Semgrep. A gitleaks skill runs gitleaks. Nobody orchestrates all of them, merges the output, kills the false positives, and hands back one ranked report. That division of labour is not stylistic. Measured on identical tasks, LLM review filters of false positives when asked directly and when given tools and structure. It is far better at refuting a finding than originating one — so the scanners originate. Every tool is free and open source. No account or licence is required for any of them.
README
以下は原文 README の抜粋です。原文を見る。
Why this exists
Claude Code already ships /security-review, and it is good at what it does — an LLM
reads the diff on your branch and reasons about it. What it does not do is execute a
scanner. It cannot walk your git history for a key you committed eight months ago, it
does not know a transitive dependency has a published CVE, and it never touches a running
app.
The tools that do execute scanners are single-domain. The Semgrep plugin runs Semgrep. A gitleaks skill runs gitleaks. Nobody orchestrates all of them, merges the output, kills the false positives, and hands back one ranked report.
That gap is what this fills.
| Scanners find | Semgrep, gitleaks, TruffleHog, Trivy, osv-scanner, Checkov, ZAP, nuclei and the language-native tools produce candidates |
| Claude verifies | Each candidate is traced to real code before it reaches the report. Untraceable findings are discarded, and the report says how many |
| You get one report | Ranked by exploitability, tagged to OWASP Top 10 2025, with an optional evidence appendix for ISO 27001, ISO 42001, GDPR and DPDPA |
That division of labour is not stylistic. Measured on identical tasks, LLM review filters 36% of false positives when asked directly and 95% when given tools and structure. It is far better at refuting a finding than originating one — so the scanners originate.
Coverage
| Domain | Tools |
|---|---|
| SAST | Semgrep, Bandit, gosec, Brakeman |
| Secrets | gitleaks, TruffleHog — full git history, not just the working tree |
| Dependencies | osv-scanner, Trivy, govulncheck, npm/pnpm audit, pip-audit, Grype, Syft, cargo/composer/bundler/dotnet |
| IaC & containers | Trivy, Checkov, Hadolint, zizmor for CI workflows |
| BaaS config | Supabase row-level security, Firebase rules |
| Stack-specific | Postgres, Redis, React, Next.js, Go, Node/Express |
推奨ツール
別のキーワードを試すか、フィルタを外してください。
インストール
npx skillfish add cdmx-in/security-review