ship-safe-red-team

name	ship-safe-red-team
description	Run a multi-agent red team scan — 29 specialized security agents scan for 80+ attack classes including injection, auth bypass, SSRF, supply chain, Supabase RLS, MCP security, agentic AI, RAG poisoning, PII compliance, and more. Use when the user wants a deep security analysis beyond just secrets.
argument-hint	[path] [--agents <list>]

Ship Safe — Red Team Scan

You are running a multi-agent red team scan using Ship Safe's 29 security agents.

Step 1: Run the red team scan

npx ship-safe@latest red-team $ARGUMENTS --json --no-ai 2>/dev/null

If $ARGUMENTS is empty, default to .:

npx ship-safe@latest red-team . --json --no-ai 2>/dev/null

If the user wants specific agents only, use the --agents flag:

npx ship-safe@latest red-team . --agents injection,auth,ssrf --json --no-ai 2>/dev/null

Available agents include: injection, auth, ssrf, supply-chain, config, llm, mobile, git-history, cicd, api, supabase-rls, mcp, agentic, rag, pii, agent-config, memory-poisoning, managed-agent, hermes, agent-attestation, agentic-supply-chain, roblox-security, model-scan, trust-boundary, slopsquat, clickfix, install-guard

Step 2: Parse and present results

The JSON output contains findings from each agent. Present results grouped by agent:

For each agent that found issues:

1. Agent name and category (e.g., "InjectionTester — Code Vulnerabilities")
2. Finding count by severity
3. Top findings — list critical and high severity findings with:
   • File and line number
   • Rule name and description
   • Code context (if available, show the flagged line with surrounding lines)
   • Suggested fix
   • Confidence level

Agent summary table

Show a table: Agent | Findings | Critical | High | Medium

Agents with zero findings

List them briefly as clean — this is useful context.

Step 3: Deep dive and remediation

For the most critical findings:

1. Read the actual source file for full context
2. Explain the vulnerability in plain language — what could an attacker do?
3. Offer to fix it with a concrete code change
4. After fixing, offer to re-run just that agent to verify: npx ship-safe@latest red-team . --agents <agent>

Step 4: Recommendations

Based on the results, suggest:

• Which agents to focus on (highest finding count or most critical findings)
• Whether to create a baseline (/ship-safe-baseline) for the current state
• Framework-specific hardening tips based on detected stack (from recon agent)

Important Notes

• The scanner includes 29 built-in agents. Recon, verification, and scoring run as supporting phases around the agent pool.
• Agents run in parallel — the scan should complete in under 60 seconds for most projects
• Low-confidence findings in test files or documentation are likely false positives
• Never display actual secret values