ship-safe-red-team
Run a multi-agent red team scan — 29 specialized security agents scan for 80+ attack classes including injection, auth bypass, SSRF, supply chain, Supabase RLS, MCP security, agentic AI, RAG poisoning, PII compliance, and more. Use when the user wants a deep security analysis beyond just secrets.
git clone --depth 1 https://github.com/asamassekou10/ship-safe /tmp/ship-safe-red-team && cp -r /tmp/ship-safe-red-team/claude-code-plugin/skills/ship-safe-red-team ~/.claude/skills/ship-safe-red-teamSKILL.md
# Ship Safe — Red Team Scan You are running a multi-agent red team scan using Ship Safe's 29 security agents. ## Step 1: Run the red team scan ```bash npx ship-safe@latest red-team $ARGUMENTS --json --no-ai 2>/dev/null ``` If `$ARGUMENTS` is empty, default to `.`: ```bash npx ship-safe@latest red-team . --json --no-ai 2>/dev/null ``` If the user wants specific agents only, use the `--agents` flag: ```bash npx ship-safe@latest red-team . --agents injection,auth,ssrf --json --no-ai 2>/dev/null ``` Available agents include: `injection`, `auth`, `ssrf`, `supply-chain`, `config`, `llm`, `mobile`, `git-history`, `cicd`, `api`, `supabase-rls`, `mcp`, `agentic`, `rag`, `pii`, `agent-config`, `memory-poisoning`, `managed-agent`, `hermes`, `agent-attestation`, `agentic-supply-chain`, `roblox-security`, `model-scan`, `trust-boundary`, `slopsquat`, `clickfix`, `install-guard` ## Step 2: Parse and present results The JSON output contains findings from each agent. Present results grouped by agent: ### For each agent that found issues: 1. **Agent name and category** (e.g., "InjectionTester — Code Vulnerabilities") 2. **Finding count** by severity 3. **Top findings** — list critical and high severity findings with: - File and line number - Rule name and description - Code context (if available, show the flagged line with surrounding lines) - Suggested fix - Confidence level ### Agent summary table Show a table: Agent | Findings | Critical | High | Medium ### Agents with zero findings List them briefly as clean — this is useful context. ## Step 3: Deep dive and remediation For the most critical findings: 1. Read the actual source file for full context 2. Explain the vulnerability in plain language — what could an attacker do? 3. Offer to fix it with a concrete code change 4. After fixing, offer to re-run just that agent to verify: `npx ship-safe@latest red-team . --agents <agent>` ## Step 4: Recommendations Based on the results, suggest: - Which agents to focus on (highest finding count or most critical findings) - Whether to create a baseline (`/ship-safe-baseline`) for the current state - Framework-specific hardening tips based on detected stack (from recon agent) ## Important Notes - The scanner includes 29 built-in agents. Recon, verification, and scoring run as supporting phases around the agent pool. - Agents run in parallel — the scan should complete in under 60 seconds for most projects - Low-confidence findings in test files or documentation are likely false positives - Never display actual secret values
Manage your security baseline — accept current findings as known debt, then only report new regressions on future scans. Use when the user wants to adopt security scanning incrementally or suppress existing findings.
Run Ship Safe in CI mode — compact output, exit codes, SARIF generation. Use when the user wants to set up CI/CD security gates or test their pipeline configuration.
Run a deep security audit with LLM-powered taint analysis — regex scan nominates findings, then an LLM verifies taint reachability and exploitability. Use when the user wants thorough, high-confidence results with fewer false positives.
Auto-fix security issues — remediate hardcoded secrets and common vulnerabilities (TLS bypass, debug mode, XSS, shell injection, Docker :latest). Use when the user wants to automatically fix security findings.
Install ship-safe as real-time Claude Code hooks — blocks secrets and dangerous commands before they land on disk. Use when the user wants automatic security scanning on every file write or bash command.
Quick scan for leaked secrets — API keys, passwords, tokens, database URLs. Use when the user wants to check for hardcoded secrets or exposed credentials.
Get your project's security health score (0-100, A-F grade). Use when the user wants a quick security check or asks "is my code safe to ship?
Run a full security audit on this project — 16 agents scan for secrets, injections, auth bypass, SSRF, supply chain, Supabase RLS, MCP security, agentic AI, RAG poisoning, PII compliance, and more. Use when the user wants a security audit, vulnerability scan, or asks if their code is safe to ship.