security-radar — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited security-radar (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Continuous-monitoring counterpart to /security-scan. Where /security-scan vets a repo before you install it, security-radar watches the surface you already run — installed Claude Code skills, configured MCP servers, project dependencies, and permission configs — and cross-references them against live advisory feeds and the OWASP frameworks. It produces a plain-English posture brief.
It is read-only: it inspects config files and lockfiles and changes nothing.
From the kit folder (or wherever you placed the script):
python3 security-radar.py # audit deps in the current project + your global surface
python3 security-radar.py --path /path/to/a/client/project
python3 security-radar.py --json # machine-readable outputNo installs needed — it uses the Python standard library only. If a tool (npm) or the network (OSV.dev) is unavailable, that check is skipped and noted; the rest still runs.
~/.claude/skills, ~/.claude/plugins) — static-scans each for risky shapes (remote-pipe-to-shell, eval of fetched code, hardcoded credentials). → OWASP LLM05 Supply Chain~/.claude.json, Claude Desktop config) — flags 3rd-party / remote servers not on the trusted-vendor list that may mediate your auth tokens. → LLM07 Insecure Plugin Design~/.claude/settings.json) — flags bypassPermissions and unconstrained allow rules. → LLM08 Excessive Agency / A01 Broken Access Controlpackage.json / requirements.txt) — npm audit + OSV.dev cross-check for known-vulnerable versions. → LLM05 / A06 Vulnerable ComponentsRun the script, then summarize the posture brief for the user: lead with the overall rating (CLEAN / CARE / QUARANTINE / REJECT), then walk the highest-severity findings first with the concrete fix for each. The full brief is also saved to ~/security-radar-report-<date>.md. Encourage a weekly cadence and designating one owner per team.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.