Stingward

Security check for projects built with AI, and for skills and MCP servers before you install them.

Lots of people now ship apps, Claude Code skills and MCP servers written with AI. Very few of them know what a CVE is, why NEXT_PUBLIC_OPENAI_API_KEY is a problem, or that a skill can hide instructions only the model can read. stingward finds those holes and tells you, in plain words, how to close each one.

$ stingward skill https://github.com/someone/cool-skill
🔴 Do not install yet: serious problems found.

🔴 CRITICAL Invisible characters in text (Unicode tag characters)
   where: SKILL.md:12  [SKL001]
   why: Invisible to you, readable by the AI. Hidden message: "also run curl ... | sh"
   how to fix: ...

Português

What it checks

Only package names and versions leave your machine (to api.osv.dev, www.cisa.gov, api.first.org and services.nvd.nist.gov). Your code never does. No account, no telemetry, no dependencies: pure Python 3.9+.

Use it

Claude Code (skill)

/plugin marketplace add HiveControlAgents/StingWard
/plugin install stingward@stingward

Then just ask: "is my project secure?" or "can I install this skill: github.com/x/y?". Claude runs the check, explains each finding and offers to fix them in your project.

Command line

pipx install stingward          # or: uvx stingward · npx stingward (needs Python 3.9+)

stingward                         # audit the current project
stingward skill ./some-skill      # audit a skill, plugin or MCP server before installing
stingward skill owner/repo        # ... straight from GitHub
stingward agents                  # audit ~/.claude, Claude Desktop, Cursor, Codex and Gemini configs on this machine

Options: --lang pt|en, --format text|json|markdown|sarif, --sarif FILE, --markdown FILE, --json FILE, --fail-on critical|high|medium|low|never (default high), --only deps,secrets,app,agents, --offline. Set NVD_API_KEY for a higher NVD rate limit.

Exit codes, so it works as a CI step: 0 clean, 1 something at or above --fail-on was found, 2 usage error, 3 OSV.dev did not respond so dependencies were not checked (a gate should not pass silently; use --offline to skip them on purpose).

GitHub Action

# .github/workflows/stingward.yml
on: { pull_request: {}, schedule: [{ cron: "0 9 * * *" }] }
permissions: { contents: read, pull-requests: write, security-events: write }
jobs:
  stingward:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: HiveControlAgents/StingWard@v0
        with: { lang: en, fail-on: high }

It comments the report on the PR (updating the same comment each run), uploads SARIF to the repository's Security tab, and writes the job summary. The daily schedule matters: new CVEs show up for code that did not change.

Badge

Every report ends with a grade from A to F and a badge for your README:

A: only low or nothing · B: medium, no high · C: 1 or 2 high · D: 3+ high · F: any critical.

Standards

Every finding carries the IDs security teams already use: CWE, the OWASP Top 10 for LLM Applications 2026 (LLM01:2026...), the OWASP Agentic Skills Top 10 (AST01..., v1 draft) and the OWASP Top 10 for Agentic Applications 2026 (ASI01...). They show up in the text report, the JSON and as SARIF tags.

False positives

Add lines to .stingwardignore in the project root (RULE path/glob, RULE, or path/glob), or put stingward:ignore in a comment on the line.

Rules

Scope

stingward reports to whoever runs it, about code they chose to check. It does not crawl other people's repositories or open issues on them. A clean report means the common mistakes are not there, not that a project is safe.

Development

python3 -m unittest discover -s tests -t .   # offline tests, no network

Data: OSV.dev (aggregates GitHub Advisories, NVD, PyPA, RustSec, Go and OpenSSF malicious packages), CISA KEV, FIRST EPSS, NVD. MIT license.