メニュー
Run the toolkit's security commands in order to surface secrets, MCP supply-chain issues, install drift, release provenance gaps, and untrusted-code risks before shipping. Use before opening a PR, after adding a dependency, or whenever the security posture needs a fresh check.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
| name | harden |
| description | Run the toolkit's security commands in order to surface secrets, MCP supply-chain issues, install drift, release provenance gaps, and untrusted-code risks before shipping. Use before opening a PR, after adding a dependency, or whenever the security posture needs a fresh check. |
| argument-hint | [optional: -- <cmd> to sandbox-test a specific command] |
| allowed-tools | Read, Grep, Glob, Bash |
Run each command in sequence. Stop on a non-zero exit and fix the finding before proceeding. All five must pass before the branch is considered hardened.
compass scan --stagedScan the staged diff for secrets at the commit boundary.
compass scan --staged
Exits 0 (clean) or 1 (secrets found). Fix: remove the secret, rotate the
credential, then re-stage. Add an # allowlist secret comment ONLY for
confirmed test fixtures — never real credentials.
scripts/check-mcp.shVerify every auto-installed MCP server is pinned to an exact version and that
no @latest float or shell-injection marker has crept in.
bash scripts/check-mcp.sh
Exits 0 (pinned + clean) or non-zero (floating version or injection marker).
Fix: pin the version in mcp/servers.json and re-run. (setup-mcp.sh runs this
same audit as a pre-flight, and compass doctor includes it.)
compass driftCheck that the installed ~/.claude config still matches this repo's source.
Catches hand-edited copies, stale hooks, and non-executable guardrail scripts.
compass drift
Exits 0 (in sync) or non-zero (drift detected). Fix: re-run quickstart.sh
or remove the hand-edited file and let the install re-link it.
compass verifyVerify the latest release tarball's keyless SLSA attestation. Requires gh.
compass verify
Exits 0 (attestation valid), 77 (gh lacks attestation support — skip), or non-zero (attestation missing or invalid). A 77 is a safe skip on old gh versions; anything else is a provenance gap to investigate.
compass sandbox -- <cmd>Run any untrusted command inside a real OS sandbox (no network, writes confined to cwd/tmp via bwrap/firejail/sandbox-exec). Required before executing code fetched from external sources.
compass sandbox -- <cmd>
Exits 0 (ran confined), 2 (usage error — supply a command), or non-zero if the sandboxed command itself fails. If no backend is available the CLI refuses to run the command unconfined — install bwrap or firejail first.
compass scan --staged should also be wired as a pre-commit hook
(compass scan --staged in .git/hooks/pre-commit) for continuous coverage.compass scan, compass verify) and drift detection (compass drift)
are also surfaced in compass dashboard for a fleet-wide view./security-review — it gates the mechanical
checks. Run /security-review on the diff for human-judgment findings.Use at the START of any task in a compass-enabled repo, or whenever you're unsure which capability fits. Indexes compass's guardrails, red-team, router, commands, subagents, and skills so you reach for the right tool instead of working ad-hoc. Read this before hand-writing config, reviewing a diff, adding a dependency, picking a model, or running untrusted code.
Take every open PR end-to-end — diagnose failing checks, classify them (real defect vs mechanical vs environmental), fix the mechanical ones on the PR branch, re-verify, and stop at the merge gate. Use on demand ("handle the open PRs") or on an interval via /loop (e.g. "/loop 15m /pr-shepherd"). Merges only when the human has granted merge authority in the current session; otherwise reports ready-to-merge.
Discovery for an autonomous loop — find this turn's work instead of being handed it. Reads what changed since the last run (failed CI, new issues, merged commits), judges what's actually worth acting on, writes findings to a durable state file, and hands each off to the SDLC loop with a stop-condition. Use as the first move of a scheduled loop, or by hand to plan a session. Read-only on code; never edits, opens PRs, or merges.
Use when something is broken — a failing test, panic, stack trace, error log, or wrong behavior whose cause isn't obvious. Reproduce it, form a hypothesis, PROVE the cause before changing code, then make the minimal root-cause fix and guard it with a test. For deep cases, hand off to the debugger subagent.
Use before claiming ANY task done, fix verified, check passing, or PR ready. Establish how the change is checked and actually run it — tests, typecheck, lint, the local gate, or the app itself — and observe it pass. Never report "should work" or pass along a subagent's unproven claim.
Detect the work type of a task or diff and dispatch the right specialist review/agent. Use when you're about to review or implement and want the correct domain reviewer (UI/design, API/devex, infra, docs, core) instead of a generic pass. The local mirror of the SDLC Classifier + domain-routed reviewers.