claudesec / scripts
AGENTS.md16 starsChanged 6 months agoMITView on GitHub
Automation scripts for scan execution, dashboard building, asset collection, and data synchronization. Most scripts are standalone bash or Python 3 — no framework required.
- Reads credentials
In this repository14 other files it gives its agents.
- AGENTS.mdAGENTS.md
- docs/AGENTS.mdAGENTS.md
- scanner/AGENTS.mdAGENTS.md
- .claude/CLAUDE.mdCLAUDE.md
- CLAUDE.mdCLAUDE.md
- .cursor/rules/claude-agents-and-practices.mdcCursor rule
- .cursor/rules/claudesec-project.mdcCursor rule
- .cursor/rules/markdown-quality.mdcCursor rule
- .cursor/rules/no-sensitive-paths.mdcCursor rule
- .cursor/rules/security-citations.mdcCursor rule
- ci-config-guard-claudesecSkill
- kcov-debugSkill
- lychee-redirect-triageSkill
- omc-referenceSkill
The file
Files
AGENTS.md
AGENTS.md — scripts/
<!-- Parent: ../AGENTS.md --><!-- Generated: 2026-07-07 -->Purpose
Automation scripts for scan execution, dashboard building, asset collection, and data synchronization. Most scripts are standalone bash or Python 3 — no framework required.
Key Scripts
| Script | Language | Purpose |
run-scan.sh | bash | Run scanner locally |
run-scan-docker.sh | bash | Run scanner in Docker |
run-dashboard-safe.sh | bash | Full scan + serve with port fallback |
run-dashboard-docker.sh | bash | Dashboard workflow in Docker |
run-full-dashboard.sh | bash | Full scan + all integrations + serve |
build-dashboard.py | Python | Collect data from all sources, build HTML |
collect-assets.sh | bash | Collect assets from Jamf, AWS, etc. |
asset-gsheet-sync.py | Python | Sync asset data to Google Sheets |
full-asset-sync.py | Python | Full multi-source sync to Sheets |
sync-notion-audits-mcp.py | Python | Sync audit evidence to Notion (MCP) |
sync-scan-to-dashboard.sh | bash | Pipeline: scan result → dashboard |
sync-cost-xlsx.py | Python | Sync SaaS cost data from Excel |
token-expiry-gate.py | Python | Enforce token expiry before scans |
isms-p-report.py | Python | Generate ISMS-P compliance report |
setup.sh | bash | Install hooks, templates, virtualenv |
setup-legal-intel.sh | bash | Clone/update legalize-kr and GitHub Repo MCP, then write .mcp.json |
legalize-search.sh | bash | Search Korean law Markdown and inspect law history from local mirror |
run-github-repo-mcp.sh | bash | Launch local GitHub Repo MCP build with npx fallback |
gh-merge-ready-pr.sh | bash | Wait for GitHub checks and mergeability propagation, then merge a PR with retries |
gh_rerun_stuck_checks.py | Python | Detect check-runs stuck in_progress after their workflow run CONCLUDED, and re-run the owning workflow (--rerun); reports only by default |
quick-start.sh | bash | Docker-first onboarding |
lint-shell.sh | bash | ShellCheck wrapper (local + CI) |
gsheet-auth.py | Python | Google Sheets OAuth helper |
gsheet-auth-setup.py | Python | gspread OAuth2 auth setup guide/helper |
update-pc-sheet.py | Python | PC inventory sheet updater |
pre-push.sh | bash | Git pre-push hook source (blocks direct push to main) |
sync-repo-protection.sh | bash | Sync GitHub branch-protection / ruleset to the codified config (backs protection-drift-watch.yml) |
check-pull-request-target-guard.py | Python | Audit workflows' pull_request_target triggers for the fork guard (backs lint.yml's workflow-fork-guard) |
check-prowler-python-ceiling.sh | bash | Watch prowler's PyPI metadata for the Python <3.13 ceiling (backs prowler-python-watch.yml) |
dev-machine-hardening.sh | bash | macOS dev-machine hardening helper |
github-setup-labels.sh | bash | Create the recommended GitHub labels for this repo |
og-meta-verify.sh | bash | Fetch the deployed page's OG/Twitter meta + image and verify |
run-prowler-k8s.sh | bash | Run a Prowler K8s scan as an in-cluster Pod (EKS) |
run-asset-sync.sh | bash | Run the Google Sheets asset-management sync |
sync-notion-licenses.py | Python | Sync the Notion software-license DB → dashboard-data.json |
update-license-active-accounts.py | Python | Update the license sheet's active_accounts column from real usage |
generate_ai_devsecops_ppt.py | Python | Generate the AI-DevSecOps PPTX deck |
generate_ai_devsecops_from_template.py | Python | Build the AI-DevSecOps deck from a template |
generate_security_seminar_template_ppt.py | Python | Generate the 30-min security-seminar PPTX template |
verify-shell-coverage-docker.sh | bash | Run the CI scanner-shell-coverage kcov flow locally in an ubuntu+kcov container (kcov does not work on macOS); pre-verify the 90% bash floor |
For AI Agents
Conventions
- Bash scripts: ShellCheck-clean. Run
./scripts/lint-shell.shbefore committing. - Python scripts: PEP 8. Use
os.getenv()for all credentials — no hardcoded values. - Dashboard scripts read from
~/Desktop/.envfor API keys (not committed). claudesec-dashboard.html(the security-scan dashboard; no longer served — its compliance/OWASP rollups are published intoscan-report.jsonand rendered inside the ISMS dashboard, and/scan.html301s to/) plusscan-report.jsonare generated artifacts in.gitignore— regenerated bydashboard-refresh.yml(a repo self-scan; no external API keys needed).claudesec-asset-dashboard.htmlis committed on purpose (it is NOT gitignored):build-dashboard.pyneeds operator secrets (Datadog / Notion / Jamf / Google Sheets) and produces org-specific asset data, so it is not auto-regenerated in public CI. An operator rebuilds it locally (python3 scripts/build-dashboard.py) and commits the refresh.
Required Environment Variables
| Variable | Used by |
DD_API_KEY, DD_APP_KEY | build-dashboard.py, sync-scan-to-dashboard.sh |
ASSET_SHEET_ID, AI_SHEET_ID | asset-gsheet-sync.py, full-asset-sync.py |
NOTION_TOKEN, NOTION_DB_ID | sync-notion-audits-mcp.py |
GITHUB_TOKEN | run-github-repo-mcp.sh, MCP clients using GitHub Repo MCP |
JAMF_URL, JAMF_TOKEN | collect-assets.sh |
GH_TOKEN / GITHUB_TOKEN | token-expiry-gate.py, scanner saas checks |
Running the Dashboard
# Safe mode (auto port fallback, no Docker required)
./scripts/run-dashboard-safe.sh
# Kill stale process and serve
./scripts/run-dashboard-safe.sh --kill-port
# Docker mode
./scripts/run-dashboard-docker.sh
# Build only, no serve
./scripts/run-full-dashboard.sh --no-serveDashboard served at http://localhost:11777/.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.