agentleFS
Sign inStart free
aiconnaiaiconnai/engram/skills/agentshield-scan/SKILL.md

agentshield-scan

Skill3 starsChanged 10 months agoMITView on GitHub

Weekly or manual security triage loop that executes AgentShield with a hard iteration cap and records the result in a repository state file.

The file

Show its rules and text

We split this skill into the rules it gives an agent

13 rules. About 0 are common, 7 are distinctive, and 6 are very specific to this project.

  • ≈0

    Common · estimate

    Many files like this have a rule of this kind.

  • ≈7

    Distinctive · estimate

    This author's own choices. Worth a look.

  • 6

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  • could be automatic: a setting could enforce it
  1. Distinctive:

    Run a bounded security scan on the repository using AgentShield, enforce a high-severity gate, and record outcomes so the loop can resume …

    line 11
  2. Very specific:

    Check that the agentshield command is available on the path before running scans.

    line 17
  3. Very specific:

    Run bash scripts/run-agentshield-loop.sh so the scan uses the repository's bounded wrapper.

    line 18
  4. Very specific:

    Keep LOOP_MAX_ITERATIONS between 1 and 5.

    line 19
  5. Very specific:

    Run agentshield scan . --ignore-tests --fail-on high --explain through the wrapper's gate path.

    line 20
  6. Very specific:

    Use .agentshield-baseline.json only after explicit review.

    line 21
  7. Distinctive:

    Never auto-fix, auto-commit, or auto-push scanner findings from this loop.

    line 25
  8. Distinctive:

    Never disable the scanner or bypass high-severity findings without a documented safety exception.

    line 26
  9. Distinctive:

    Never commit raw API credentials, private keys, or tokens to the repository.

    line 27
  10. Distinctive:

    Never expose API secrets or tokens in execution logs.

    line 28
  11. Distinctive:

    Never bypass the gate validation on failure.

    line 29
  12. Distinctive:

    Never mount production credentials or run the loop with broader privileges than repository read access.

    line 30
  13. Very specific:

    Read and update the local STATE.md file located at docs/loops/agentshield-scan/STATE.md after every iteration.

    line 33

≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

AgentShield Security Scan Skill Instructions

Objective

Run a bounded security scan on the repository using AgentShield, enforce a high-severity gate, and record outcomes so the loop can resume across sessions. This loop is for static security triage only; it does not remediate findings by itself.

Always Do

  • Check that the agentshield command is available on the path before running scans.
  • Run bash scripts/run-agentshield-loop.sh so the scan uses the repository's bounded wrapper.
  • Keep LOOP_MAX_ITERATIONS between 1 and 5; the default is 1.
  • Run agentshield scan . --ignore-tests --fail-on high --explain through the wrapper's gate path.
  • Use .agentshield-baseline.json only after explicit review; create it with LOOP_WRITE_BASELINE=1.
  • Append a structured entry to docs/loops/agentshield-scan/STATE.md after every iteration.

Never Do

  • Never auto-fix, auto-commit, or auto-push scanner findings from this loop.
  • Never disable the scanner or bypass high-severity findings without a documented safety exception.
  • Never commit raw API credentials, private keys, or tokens to the repository.
  • Never expose API secrets or tokens in execution logs.
  • Never bypass the gate validation on failure.
  • Never mount production credentials or run the loop with broader privileges than repository read access.

State Handoff

  • Read and update the local STATE.md file located at docs/loops/agentshield-scan/STATE.md after every iteration.
  • Record whether the run used a baseline, the iteration cap, and any non-zero exit code.

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free