[!警告] Skunkworks 项目。睁开眼睛使用。 这是一项积极的研究工作，而非生产级工具。请期待出现粗糙的部分：

• 无长期支持。 一切可能在未通知的情况下发生变化。
• 未知覆盖缺口。 检测规则为参考，非生产级;部分漏洞类别或语言模式将被遗漏。不断演进并添加新内容！
• 无误报保证。 精度因仓库大小、语言和扫描变体而异，预计存在噪声。
• 成本不可预测性。 LLM令牌的使用高度依赖于仓库规模和所选变体;大型仓库可能迅速变得昂贵。
• 不能替代人工审核。 发现应由人工进行分诊后再采取行动。

---

这是什么

Railguard 是一个基于大型语言模型（LLM）驱动的静态安全分析实验。这是一个模拟不同快速评估方法的仓库，利用 Claude Code 代理技能扫描源代码仓库以寻找安全漏洞;无运行时执行，无动态测试，纯粹读与推理。

Railguard: Scan Skills

[!WARNING] Skunkworks project. Use with eyes open. This is an active research effort, not production-grade tool(s). Expect rough edges:

• No long-term support. All things may change without notice.
• Unknown coverage gaps. Detection rules included are references, not production grade; some vulnerability classes or language patterns will be missed. Evolve and add seasoning!
• No false-positive guarantees. Precision varies by repo size, language, and scan variant, expect noise.
• Cost unpredictability. LLM token usage depends heavily on repo size and variant chosen; large repos can get expensive fast.
• Not a replacement for manual review. Findings should be triaged by a human before acting on them.

---

What This Is

Railguard is an experiment in LLM-driven static security analysis. This is a repository emulating the different approaches for quick evaluation leveraging Claude Code agent skills to scan source code repositories for security vulnerabilities; no runtime execution, no dynamic testing, pure read-and-reason.

The core question driving the work: does splitting analysis across many specialized agents produce meaningfully better results than having one agent do everything? There’s no obvious right answer. More agents means more focused analysis per domain, but also more cost, more orchestration complexity, and no cross-domain correlation. Fewer agents is cheaper and simpler, but the model has to juggle more rules and may give each vulnerability class shallow attention. We’re running controlled experiments to find out where the breakpoints are.

Each scan variant shares the same rule files, methodology docs, and benchmark infrastructure. The only thing that changes is how Phase 3 (vulnerability analysis) is structured.

---

Repository Structure

.
├── LICENSE.md
├── README.md
├── repos/                                         # Eval target repositories
│   ├── vul-anime-rest-api/                        # Intentionally vulnerable FastAPI app
│   └── ...                                        # More to come
│
└── .claude/
    └── skills/
        ├── README.md                              # Skills-level docs (eval focus)
        │
        ├── railguard-orchestrated-scan/           # 12 parallel specialized agents (canonical baseline)
        │   ├── SKILL.md                           # Orchestrator entry point
        │   ├── references/
        │   │   ├── directives/                    # Universal agent directives (tool logging etc.)
        │   │   ├── methodology/                   # Data flow, severity, FP, triage, dedup
        │   │   ├── rules/                         # 12 vulnerability detection rules
        │   │   └── schemas/                       # Finding JSON format
        │   ├── scripts/                           # File enumeration, LSP helpers, merge, semgrep