asamassekou10/ship-safe-score
claude-code-plugin/skills/ship-safe-score/SKILL.md
Get your project's security health score (0-100, A-F grade). Use when the user wants a quick security check or asks "is my code safe to ship?"
$ install --global
skillsauthnpx skillsauth add asamassekou10/ship-safe ship-safe-scoreInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 16, 2026, 8:52 AM9.1s1 file scanned
SKILL.md
- name:
- ship-safe-score
- description:
- Get your project's security health score (0-100, A-F grade). Use when the user wants a quick security check or asks "is my code safe to ship?
- argument-hint:
- [path] [--no-deps]
Ship Safe — Security Score
You are checking this project's security health score.
Step 1: Run the score command
npx ship-safe@latest score $ARGUMENTS 2>&1
If $ARGUMENTS is empty, default to .:
npx ship-safe@latest score . 2>&1
If the user mentions skipping dependencies, add --no-deps.
The command outputs styled terminal text (not JSON). Parse the output for the score, grade, and category breakdown.
Step 2: Present the results
Extract and present:
- Score and Grade: The 0-100 score and A-F letter grade
- Category Breakdown: Show deductions per category (Secrets, Code Vulnerabilities, Dependencies)
- Grade Meaning:
- A (90-100): Ship it! Your code looks secure.
- B (75-89): Minor issues to review, but generally safe.
- C (60-74): Fix issues before shipping to production.
- D (40-59): Significant security risks present.
- F (0-39): Not safe to ship. Critical issues found.
Step 3: Recommendations
Based on the score:
-
A or B (75+): Congratulate the user. Suggest running
npx ship-safe guardto install a pre-push git hook that maintains the score. Mention they can run/ship-safefor a detailed breakdown anytime. -
C (60-74): Recommend running
/ship-safefor a full audit to see exactly what needs fixing. Mention the most likely problem areas based on the category breakdown. -
D or F (below 60): Strongly recommend running
/ship-safeimmediately. Offer to start the full audit right now. Emphasize that critical findings should be fixed before any deployment. -
For any score, mention
/ship-safe-baselineto track progress over time and/ship-safe-fixfor automated remediation.
Related Skills
asamassekou10/ship-safe
tools
VerifiedTrustedCommunity
Run a full security audit on this project — 16 agents scan for secrets, injections, auth bypass, SSRF, supply chain, Supabase RLS, MCP security, agentic AI, RAG poisoning, PII compliance, and more. Use when the user wants a security audit, vulnerability scan, or asks if their code is safe to ship.
420SKILL.mdUpdated Apr 16, 2026
asamassekou10/ship-safe-scan
development
VerifiedTrustedCommunity
Quick scan for leaked secrets — API keys, passwords, tokens, database URLs. Use when the user wants to check for hardcoded secrets or exposed credentials.
420SKILL.mdUpdated Apr 16, 2026
asamassekou10/ship-safe-red-team
tools
VerifiedTrustedCommunity
Run a multi-agent red team scan — 16 specialized security agents scan for 80+ attack classes including injection, auth bypass, SSRF, supply chain, Supabase RLS, MCP security, agentic AI, RAG poisoning, PII compliance, and more. Use when the user wants a deep security analysis beyond just secrets.
420SKILL.mdUpdated Apr 16, 2026
asamassekou10/ship-safe-hooks
development
VerifiedTrustedCommunity
Install ship-safe as real-time Claude Code hooks — blocks secrets and dangerous commands before they land on disk. Use when the user wants automatic security scanning on every file write or bash command.
420SKILL.mdUpdated Apr 16, 2026