ktg-plugin-marketplace/plugins/llm-security/commands/posture.md

name	description	allowed-tools	model
security:posture	Quick security posture assessment — scorecard with grade, coverage status, and top recommendations	Read, Glob, Grep, Bash	sonnet

/security posture

Quick security scorecard — grade, coverage, top recommendations. Deterministic scanner, <2 sec.

Step 1: Run Scanner

Run the deterministic posture scanner:

node <this plugin's scanners/posture-scanner.mjs> [target-path or cwd]

Parse the JSON output. The result contains:

• scoring.grade (A-F), scoring.pass_rate, scoring.pass/partial/fail/na
• risk.score (0-100), risk.band, risk.verdict
• categories[] with id, name, status, findings_count, evidence
• findings[] with severity, title, description, owasp, recommendation
• counts with critical/high/medium/low/info

Step 2: Format Scorecard

Present the results as a scorecard:

# Security Posture — [project name]

| Field | Value |
|-------|-------|
| **Grade** | [A-F] |
| **Risk Score** | [N]/100 ([band]) |
| **Verdict** | [verdict] |
| **Duration** | [N]ms |

## Category Scorecard

| # | Category | Status | Findings |
|---|----------|--------|----------|
[one row per category, status as PASS/PARTIAL/FAIL/N-A]

## Top Findings

[List critical and high findings with title, file, and recommendation]

## Quick Wins

[List low-effort fixes from findings]

Step 3: Closing

• Grade A/B: "Posture solid. Re-run after major changes."
• Grade C: "Run /security audit for detailed findings."
• Grade D/F: "Significant exposure. Run /security audit before production use."