feat: initial open marketplace with llm-security, config-audit, ultraplan-local

plugins/llm-security/commands/posture.md

@@ -0,0 +1,60 @@
+---
+name: security:posture
+description: Quick security posture assessment — scorecard with grade, coverage status, and top recommendations
+allowed-tools: Read, Glob, Grep, Bash
+model: sonnet
+---
+
+# /security posture
+
+Quick security scorecard — grade, coverage, top recommendations. Deterministic scanner, <2 sec.
+
+## Step 1: Run Scanner
+
+Run the deterministic posture scanner:
+
+```
+node <this plugin's scanners/posture-scanner.mjs> [target-path or cwd]
+```
+
+Parse the JSON output. The result contains:
+- `scoring.grade` (A-F), `scoring.pass_rate`, `scoring.pass/partial/fail/na`
+- `risk.score` (0-100), `risk.band`, `risk.verdict`
+- `categories[]` with id, name, status, findings_count, evidence
+- `findings[]` with severity, title, description, owasp, recommendation
+- `counts` with critical/high/medium/low/info
+
+## Step 2: Format Scorecard
+
+Present the results as a scorecard:
+
+```
+# Security Posture — [project name]
+
+| Field | Value |
+|-------|-------|
+| **Grade** | [A-F] |
+| **Risk Score** | [N]/100 ([band]) |
+| **Verdict** | [verdict] |
+| **Duration** | [N]ms |
+
+## Category Scorecard
+
+| # | Category | Status | Findings |
+|---|----------|--------|----------|
+[one row per category, status as PASS/PARTIAL/FAIL/N-A]
+
+## Top Findings
+
+[List critical and high findings with title, file, and recommendation]
+
+## Quick Wins
+
+[List low-effort fixes from findings]
+```
+
+## Step 3: Closing
+
+- Grade A/B: "Posture solid. Re-run after major changes."
+- Grade C: "Run `/security audit` for detailed findings."
+- Grade D/F: "Significant exposure. Run `/security audit` before production use."