[!수신] Skunkworks 프로젝트. 눈과 함께 사용. 이 연구 노력은, 생산 급료 공구 (s) 아닙니다. 예상 거친 가장자리:

• ** 장기 지원 없음. ** 모든 것은 공지없이 변경 될 수 있습니다.
• 알 수 없는 적용 간격. 검출 규칙은 참고, 생산 급료 아닙니다입니다; 몇몇 취약점 종류 또는 언어 본은 놓일 것입니다. 계절에 맞게!
• ** false-positive 보장 없음. ** 정밀도는 repo 크기, 언어, 및 검사 변종에 의해, 노이즈를 예상합니다 변화합니다. -Cost unpredictability. LLM 토큰 사용은 repo 크기와 변형에 크게 의존합니다. 큰 저장소는 비싼 빨리 얻을 수 있습니다.
• ** 설명서 검토에 대한 교체가 없습니다. ** 찾기는 그들에 행동하기 전에 인간의 승리해야합니다.

---

이것은 무엇인가?

Railguard는 LLM 구동 정적 보안 분석의 실험입니다. 이것은 보안 취약점을위한 소스 코드 저장소를 스캔하기 위해 빠른 평가 레버리지 클로드 코드 에이전트 기술에 대한 다른 접근 방식을 유화하는 저장소입니다; 런타임 실행 없음, 동적 테스트 없음, 순수한 읽음 및 reason.

Railguard: Scan Skills

[!WARNING] Skunkworks project. Use with eyes open. This is an active research effort, not production-grade tool(s). Expect rough edges:

• No long-term support. All things may change without notice.
• Unknown coverage gaps. Detection rules included are references, not production grade; some vulnerability classes or language patterns will be missed. Evolve and add seasoning!
• No false-positive guarantees. Precision varies by repo size, language, and scan variant, expect noise.
• Cost unpredictability. LLM token usage depends heavily on repo size and variant chosen; large repos can get expensive fast.
• Not a replacement for manual review. Findings should be triaged by a human before acting on them.

---

What This Is

Railguard is an experiment in LLM-driven static security analysis. This is a repository emulating the different approaches for quick evaluation leveraging Claude Code agent skills to scan source code repositories for security vulnerabilities; no runtime execution, no dynamic testing, pure read-and-reason.

The core question driving the work: does splitting analysis across many specialized agents produce meaningfully better results than having one agent do everything? There’s no obvious right answer. More agents means more focused analysis per domain, but also more cost, more orchestration complexity, and no cross-domain correlation. Fewer agents is cheaper and simpler, but the model has to juggle more rules and may give each vulnerability class shallow attention. We’re running controlled experiments to find out where the breakpoints are.

Each scan variant shares the same rule files, methodology docs, and benchmark infrastructure. The only thing that changes is how Phase 3 (vulnerability analysis) is structured.

---

Repository Structure

.
├── LICENSE.md
├── README.md
├── repos/                                         # Eval target repositories
│   ├── vul-anime-rest-api/                        # Intentionally vulnerable FastAPI app
│   └── ...                                        # More to come
│
└── .claude/
    └── skills/
        ├── README.md                              # Skills-level docs (eval focus)
        │
        ├── railguard-orchestrated-scan/           # 12 parallel specialized agents (canonical baseline)
        │   ├── SKILL.md                           # Orchestrator entry point
        │   ├── references/
        │   │   ├── directives/                    # Universal agent directives (tool logging etc.)
        │   │   ├── methodology/                   # Data flow, severity, FP, triage, dedup
        │   │   ├── rules/                         # 12 vulnerability detection rules
        │   │   └── schemas/                       # Finding JSON format
        │   ├── scripts/                           # File enumeration, LSP helpers, merge, semgrep