ship-safe-score
Get your project's security health score (0-100, A-F grade). Use when the user wants a quick security check or asks "is my code safe to ship?
git clone --depth 1 https://github.com/asamassekou10/ship-safe /tmp/ship-safe-score && cp -r /tmp/ship-safe-score/claude-code-plugin/skills/ship-safe-score ~/.claude/skills/ship-safe-scoreSKILL.md
# Ship Safe — Security Score You are checking this project's security health score. ## Step 1: Run the score command ```bash npx ship-safe@latest score $ARGUMENTS 2>&1 ``` If `$ARGUMENTS` is empty, default to `.`: ```bash npx ship-safe@latest score . 2>&1 ``` If the user mentions skipping dependencies, add `--no-deps`. The command outputs styled terminal text (not JSON). Parse the output for the score, grade, and category breakdown. ## Step 2: Present the results Extract and present: 1. **Score and Grade**: The 0-100 score and A-F letter grade 2. **Category Breakdown**: Show deductions per category (Secrets, Code Vulnerabilities, Dependencies) 3. **Grade Meaning**: - A (90-100): Ship it! Your code looks secure. - B (75-89): Minor issues to review, but generally safe. - C (60-74): Fix issues before shipping to production. - D (40-59): Significant security risks present. - F (0-39): Not safe to ship. Critical issues found. ## Step 3: Recommendations Based on the score: - **A or B (75+)**: Congratulate the user. Suggest running `npx ship-safe guard` to install a pre-push git hook that maintains the score. Mention they can run `/ship-safe` for a detailed breakdown anytime. - **C (60-74)**: Recommend running `/ship-safe` for a full audit to see exactly what needs fixing. Mention the most likely problem areas based on the category breakdown. - **D or F (below 60)**: Strongly recommend running `/ship-safe` immediately. Offer to start the full audit right now. Emphasize that critical findings should be fixed before any deployment. - For any score, mention `/ship-safe-baseline` to track progress over time and `/ship-safe-fix` for automated remediation.
Manage your security baseline — accept current findings as known debt, then only report new regressions on future scans. Use when the user wants to adopt security scanning incrementally or suppress existing findings.
Run Ship Safe in CI mode — compact output, exit codes, SARIF generation. Use when the user wants to set up CI/CD security gates or test their pipeline configuration.
Run a deep security audit with LLM-powered taint analysis — regex scan nominates findings, then an LLM verifies taint reachability and exploitability. Use when the user wants thorough, high-confidence results with fewer false positives.
Auto-fix security issues — remediate hardcoded secrets and common vulnerabilities (TLS bypass, debug mode, XSS, shell injection, Docker :latest). Use when the user wants to automatically fix security findings.
Install ship-safe as real-time Claude Code hooks — blocks secrets and dangerous commands before they land on disk. Use when the user wants automatic security scanning on every file write or bash command.
Run a multi-agent red team scan — 29 specialized security agents scan for 80+ attack classes including injection, auth bypass, SSRF, supply chain, Supabase RLS, MCP security, agentic AI, RAG poisoning, PII compliance, and more. Use when the user wants a deep security analysis beyond just secrets.
Quick scan for leaked secrets — API keys, passwords, tokens, database URLs. Use when the user wants to check for hardcoded secrets or exposed credentials.
Run a full security audit on this project — 16 agents scan for secrets, injections, auth bypass, SSRF, supply chain, Supabase RLS, MCP security, agentic AI, RAG poisoning, PII compliance, and more. Use when the user wants a security audit, vulnerability scan, or asks if their code is safe to ship.