cdmx-in/security-review
Security testing이 페이지는 AI로 자동 번역되었습니다. 기술적인 세부 사항은 원문을 확인하세요. 원문 보기
Claude Code skill that runs real security scanners (Semgrep, gitleaks, TruffleHog, Trivy, osv-scanner, ZAP) then verifies every finding against source.
개요
Built and maintained by Codemax IT Solutions Pvt. Ltd. Claude Code already ships /security-review, and it is good at what it does — an LLM reads the diff on your branch and reasons about it. What it does not do is execute a scanner. It cannot walk your git history for a key you committed eight months ago, it does not know a transitive dependency has a published CVE, and it never touches a running app. The tools that do execute scanners are single-domain. The Semgrep plugin runs Semgrep. A gitleaks skill runs gitleaks. Nobody orchestrates all of them, merges the output, kills the false positives, and hands back one ranked report. That division of labour is not stylistic. Measured on identical tasks, LLM review filters of false positives when asked directly and when given tools and structure. It is far better at refuting a finding than originating one — so the scanners originate. Every tool is free and open source. No account or licence is required for any of them.
README
원문 README의 일부입니다. 원문 보기.
Why this exists
Claude Code already ships /security-review, and it is good at what it does — an LLM
reads the diff on your branch and reasons about it. What it does not do is execute a
scanner. It cannot walk your git history for a key you committed eight months ago, it
does not know a transitive dependency has a published CVE, and it never touches a running
app.
The tools that do execute scanners are single-domain. The Semgrep plugin runs Semgrep. A gitleaks skill runs gitleaks. Nobody orchestrates all of them, merges the output, kills the false positives, and hands back one ranked report.
That gap is what this fills.
| Scanners find | Semgrep, gitleaks, TruffleHog, Trivy, osv-scanner, Checkov, ZAP, nuclei and the language-native tools produce candidates |
| Claude verifies | Each candidate is traced to real code before it reaches the report. Untraceable findings are discarded, and the report says how many |
| You get one report | Ranked by exploitability, tagged to OWASP Top 10 2025, with an optional evidence appendix for ISO 27001, ISO 42001, GDPR and DPDPA |
That division of labour is not stylistic. Measured on identical tasks, LLM review filters 36% of false positives when asked directly and 95% when given tools and structure. It is far better at refuting a finding than originating one — so the scanners originate.
Coverage
| Domain | Tools |
|---|---|
| SAST | Semgrep, Bandit, gosec, Brakeman |
| Secrets | gitleaks, TruffleHog — full git history, not just the working tree |
| Dependencies | osv-scanner, Trivy, govulncheck, npm/pnpm audit, pip-audit, Grype, Syft, cargo/composer/bundler/dotnet |
| IaC & containers | Trivy, Checkov, Hadolint, zizmor for CI workflows |
| BaaS config | Supabase row-level security, Firebase rules |
| Stack-specific | Postgres, Redis, React, Next.js, Go, Node/Express |
추천 도구
다른 키워드를 입력하거나 필터를 제거해 보세요.
설치
npx skillfish add cdmx-in/security-review