| name | curness |
| description | Run local Harness SAST on source files, or SCA on dependency manifests. Use when the user asks to scan code, check dependencies or CVEs, or mentions Harness SAST and SCA, Curness, security scanning, Review, Analyze, Qwiet, or ShiftLeft. |
Harness SAST and SCA (Curness)
Analysis runs on the user’s machine: static analysis for source files, and dependency-manifest scanning using ShiftLeft package metadata. The editor extension can also scan on save; these scripts are for on-demand runs from the agent.
Where to run the scripts from
Use the directory that matches how the user installed Curness:
| Situation | Folder containing run-scan.sh | Example |
|---|
| Cursor (skill installed with the extension) | ~/.cursor/skills/curness/ | bash "$HOME/.cursor/skills/curness/run-scan.sh" /path/to/File.java |
Claude Code with --plugin-dir | <that plugin folder>/skills/scan/ | bash "<plugin>/skills/scan/run-scan.sh" /path/to/File.java |
For Claude plugins, <plugin> is the root you pass to claude --plugin-dir (it contains .claude-plugin/, hooks/, skills/, etc.). Do not assume a path under ~/.claude/plugins/ unless the user said they installed there.
The same folder holds run-sca-manifest.sh and run-sca-manifest.cjs; keep using that folder’s paths for SCA so the .sh and .cjs stay paired.
Source code scan (run-scan.sh)
Findings describe data flow as SOURCE → FLOW → SINK.
Supported file types
- Java:
.java
- C/C++:
.c, .cpp, .cc, .cxx, .h, .hpp
- JavaScript/TypeScript:
.js, .jsx, .ts, .tsx
- Python:
.py
- PHP:
.php
Before running
- Java available (
PATH or JAVA_HOME)
- Curness data under
~/.shiftleft/ (local analyzer bundle and scripts; the skill wrapper picks the best available launcher on your machine)
Run
bash "<path-to-run-scan.sh>" "<source_file_path>"
Output
Stdout may include logs. The JSON block is between:
- Start:
===FINDINGS_JSON_START===
- End:
===FINDINGS_JSON_END===
What to do with the result
- If the file’s extension is not supported, say so and skip the scan.
- Otherwise run the script and parse the JSON between the markers.
- Summarize findings (title, severity/score, source, flow, sink).
Dependency manifest scan (run-sca-manifest.sh)
Scans a manifest (for example package.json, pom.xml) for vulnerable dependencies using the same approach as the extension’s manifest flow.
Before running
- Valid ShiftLeft config at
~/.shiftleft/config.json (orgId and accessToken)
- Dependency-scan tooling installed under
~/.shiftleft/ (same layout the extension uses for manifest scans)
- For
package.json, a lockfile next to it (package-lock.json, yarn.lock, or pnpm-lock.yaml) when required
Run
bash "<path-to-run-sca-manifest.sh>" "<manifest_path>"
Output
- JSON between
===SCA_FINDINGS_JSON_START=== and ===SCA_FINDINGS_JSON_END===
- Progress lines on stderr:
[SCA] ...
What to do with the result
- Run the script on the manifest path the user cares about.
- Parse the JSON between the SCA markers (for example dependency vulnerabilities or warnings about a missing lockfile).
- Summarize for the user.
If something fails
Misconfigured credentials, missing tooling under ~/.shiftleft/, or a missing lockfile usually shows up in script output or as warnings inside the JSON. If the script file is not found, the path to the skill folder is wrong—re-check Where to run the scripts from above.
