Kjell Tore Guttormsen 03b8885b6e chore(llm-security): v7.7.2 — language consistency pass

~/.claude/CLAUDE.md specifies English for code and documentation,
Norwegian for dialog only. Norwegian had crept into surface text
across v7.5-v7.7. Translated to English in eight surfaces.

No scanner, hook, or behavior changes — purely surface text.

- 18 skill commands: the HTML Report-step now reads "HTML report:
  [Open in browser]" instead of "HTML-rapport: [Åpne i nettleser]"
- scripts/lib/report-renderers.mjs: key-stat labels, lede defaults,
  table headers, maturity-ladder descriptions, action-tier labels,
  clean buckets, dry-run/apply copy, and JS comments. Regex
  alternations /^high|^høy/ and /resolution|løsning/i preserved.
- playground/llm-security-playground.html: same renderer changes
  mirrored bit-identical, plus playground-only UI strings (catalog,
  breadcrumb aria-label, theme toggle, builder-modal hint,
  guide-panel "no projects yet", delete confirmation, alert/copy).
  Demo-state fixture content for dft-komplett-demo preserved
  (intentional Norwegian persona).
- agents/skill-scanner-agent.md + agents/mcp-scanner-agent.md:
  Generaliseringsgrense + Parallell Read-strategi sections translated
  to Generalization boundary + Parallel Read strategy.
- README.md: playground architecture prose + Recent versions table
  (v7.5.0 — v7.7.1).
- CLAUDE.md: v7.7.1 highlights translated, new v7.7.2 highlights
  added.
- ../../README.md: llm-security v7.5.0 — v7.7.1 bullets.
- ../../CLAUDE.md: llm-security catalog entry.
- docs/scanner-reference.md: six runnable-examples table cells.
- docs/version-history.md: new v7.7.2 entry. v7.5-v7.7 narrative
  sections left in original language (deferred per operator).
- Version bumped 7.7.1 → 7.7.2 in package.json,
  .claude-plugin/plugin.json, README badge + Recent versions,
  CLAUDE.md header + state, docs/version-history.md, playground
  renderHome hardcoded string, root README + CLAUDE.md llm-security
  entries.

Tests: 1820/1820 green. CLI smoke-test: 18/18 commandIds produce
>138 KB self-contained HTML. Browser-dogfood verified.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

2026-05-19 06:47:44 +02:00

2.4 KiB

Raw Blame History

name	description	allowed-tools	model
security:supply-check	Re-audit installed dependencies — check lockfiles against blocklists, OSV.dev CVEs, and typosquat detection	Read, Bash	sonnet

/security supply-check [path]

Re-audit installed dependencies in lockfiles (package-lock.json, yarn.lock, requirements.txt, Pipfile.lock) against blocklists, OSV.dev CVE database, and typosquat detection.

Unlike deep-scan (which includes dep-auditor among 9 scanners), this command runs ONLY the supply-chain-recheck scanner for a focused dependency audit.

Step 1: Setup

$ARGUMENTS empty → target = cwd. Otherwise target = first argument.
Plugin root = parent of this commands/ folder.

Step 2: Run Scanner

node <plugin-root>/scanners/supply-chain-recheck-cli.mjs "<target>"

Important: This scanner calls OSV.dev API. If offline, blocklist and typosquat checks still run but CVE detection is skipped (an INFO finding notes this).

The scanner outputs JSON to stdout. Parse it.

Step 3: Present Results

Show a summary banner:

## Supply Chain Re-check: [target]
Status: [ok|skipped|error] | Findings: XC XH XM XL XI | Files: N lockfile(s)

If osv_offline: true in result, note: "OSV.dev was unreachable — CVE check was skipped. Blocklist and typosquat checks completed."

Step 4: Detail Findings

For each finding, show:

Severity badge and title
File (lockfile) and evidence
Recommendation

Group by severity (CRITICAL first). If zero findings: "No supply chain issues detected in N lockfile(s)."

Step 5: HTML Report

After producing the markdown supply-check report above:

Compute a temp markdown path:

node -p "require('path').join(require('os').tmpdir(), 'sec-supply-check-' + Date.now() + '.md')"

Use the Write tool to save the entire markdown report you just produced (banner + lockfile coverage + all findings grouped by severity) to that temp path. Verbatim.
Run the renderer:
```
node <plugin-root>/scripts/render-report.mjs supply-check --in "<temp-md-path>"
```
The CLI writes reports/supply-check-<YYYYMMDD-HHmmss>.html relative to CWD and prints file:///abs/path.html on stdout.
Append to your response (markdown link, no bare URL):

HTML report: Open in browser

If the CLI exits non-zero, mention the error but do not block — the markdown report above is the primary deliverable.

2.4 KiB Raw Blame History