{
  "markdown": "```\n   _____ _   ____________________  __\n  / ___// | / /  _/_  __/ ____/ / / /\n  \\__ \\/  |/ // /  / / / /   / /_/ /\n ___/ / /|  // /  / / / /___/ __  /\n/____/_/ |_/___/ /_/  \\____/_/ /_/\n```\n\nEvidence-based security auditing for AI coding assistants. Zero false positives.\n\nCompatible with [Claude Code](https://docs.anthropic.com/en/docs/claude-code) · [Gemini CLI](https://github.com/google-gemini/gemini-cli) · [Codex CLI](https://github.com/openai/codex) · [OpenCode](https://github.com/opencode-ai/opencode) · [Antigravity](https://github.com/neplextech/antigravity) · [Cursor](https://www.cursor.com/)\n\n---\n\n## Why Snitch\n\nTraditional scanners flood you with hundreds of findings — half of them are `YOUR_API_KEY_HERE` in a comment. Snitch is different: every finding must be backed by real code evidence. No file read? No finding. Can't quote the exact line? No finding. Didn't check for a fix nearby? No finding.\n\nFindings are tagged with **CWE**, **OWASP Top 10:2025**, and **CVSS 4.0** references for direct GRC ingestion.\n\n---\n\n## Installation\n\n### Claude Code\n\n```\n/plugin marketplace add JF10R/Snitch\n/plugin install snitch@JF10R-Snitch\n```\n\n### Gemini CLI\n\n```bash\ngemini extensions install https://github.com/JF10R/Snitch.git\n```\n\n### Codex CLI\n\n```bash\ngit clone https://github.com/JF10R/Snitch.git\ncp -r Snitch/agents/skills/snitch ~/.codex/skills/snitch\n```\n\nPer-project: use `.agents/skills/snitch` instead.\n\n### OpenCode\n\n```bash\ngit clone https://github.com/JF10R/Snitch.git\ncp -r Snitch/skills/snitch ~/.config/opencode/skills/snitch\n```\n\nPer-project: `.opencode/skills/snitch`\n\n### Antigravity\n\n```bash\ngit clone https://github.com/JF10R/Snitch.git\ncp -r Snitch/skills/snitch ~/.gemini/antigravity/skills/snitch\n```\n\nPer-project: `.agent/skills/snitch`\n\n### Cursor\n\n```bash\ngit clone https://github.com/JF10R/Snitch.git\ncp -r Snitch/skills/snitch .cursor/skills/snitch\n```\n\n<details>\n<summary>Updating / Uninstalling</summary>\n\n| Platform | Update | Uninstall |\n|----------|--------|-----------|\n| Claude Code | `/plugin marketplace update JF10R-Snitch` | `/plugin uninstall snitch@JF10R-Snitch` |\n| Gemini CLI | `gemini extensions update snitch` | `gemini extensions uninstall snitch` |\n| Codex CLI | Re-clone and copy | `rm -rf ~/.codex/skills/snitch` |\n| OpenCode | Re-clone and copy | `rm -rf ~/.config/opencode/skills/snitch` |\n| Antigravity | Re-clone and copy | `rm -rf ~/.gemini/antigravity/skills/snitch` |\n| Cursor | Re-clone and copy | `rm -rf .cursor/skills/snitch` |\n\n</details>\n\n---\n\n## Usage\n\n```\n/snitch\n```\n\nSelect categories from the interactive menu, or run directly:\n\n```\n/snitch --categories=1,2,3,13\n/snitch --diff\n```\n\n**Quick Scan** detects your stack automatically (`package.json`, imports, config files) and only audits relevant categories.\n\n**`--diff`** scans only staged/unstaged changes — ideal as a pre-commit check.\n\n### After the scan\n\n- **Fix one by one** — walk through each finding individually\n- **Fix all** — auto-patch everything at once\n- **Run another scan** — check additional categories\n- **Done** — exit\n\n---\n\n## Categories\n\n40 audit categories organized by domain:\n\n### Application Security\n\n| # | Category | Description |\n|---|----------|-------------|\n| 01 | SQL Injection | Parameterized queries, ORM misuse |\n| 02 | XSS | Output encoding, DOM injection |\n| 03 | Hardcoded Secrets | API keys, passwords, tokens in source |\n| 04 | Authentication | Login flows, password handling, MFA |\n| 05 | SSRF | Server-side request forgery |\n| 07 | Rate Limiting | Brute-force protection, throttling |\n| 08 | CORS | Cross-origin misconfiguration |\n| 09 | Cryptography | Weak algorithms, key management |\n| 10 | Dangerous Patterns | `eval()`, dynamic code execution |\n| 28 | Authorization | Broken access control, IDOR |\n| 29 | File Uploads | Validation, path traversal |\n| 30 | Input Validation | ReDoS, injection vectors |\n| 32 | Security Headers | CSP, HSTS, X-Frame-Options |\n| 39 | Token Lifetimes | Session expiry, logout effectiveness |\n\n### Services & Integrations\n\n| # | Category | Description |\n|---|----------|-------------|\n| 06 | Supabase | Row-level security, exposed service keys |\n| 13 | Stripe | API keys, webhook verification |\n| 14 | Auth Providers | Clerk, Auth0, NextAuth configuration |\n| 15 | AI APIs | Claude, OpenAI, Gemini key exposure |\n| 16 | Email | SMTP credentials, spam abuse vectors |\n| 17 | Database | Connection strings, query security |\n| 18 | Redis | Authentication, exposed instances |\n| 19 | SMS | Twilio tokens, message injection |\n\n### Infrastructure\n\n| # | Category | Description |\n|---|----------|-------------|\n| 11 | Cloud Providers | AWS, GCP, Azure, Vercel, Cloudflare |\n| 12 | Data Leaks | Logs, error messages, debug output |\n| 31 | CI/CD | Pipeline secrets, deployment security |\n| 40 | Tunnels & DNS | ngrok, cloudflared, DNS configuration |\n\n### Compliance\n\n| # | Category | Description |\n|---|----------|-------------|\n| 20 | HIPAA | Protected health information |\n| 21 | SOC 2 | Audit trails, access controls |\n| 22 | PCI-DSS | Payment card data handling |\n| 23 | GDPR | Data deletion, consent, EU requirements |\n| 34 | FIPS 140-3 | Cryptographic module compliance |\n| 35 | Governance | ISO 27001, FedRAMP, CMMC |\n| 38 | Data Classification | Sensitivity labeling, handling policies |\n\n### Performance & Maintenance\n\n| # | Category | Description |\n|---|----------|-------------|\n| 24 | Memory Leaks | Event listeners, uncleaned resources |\n| 25 | N+1 Queries | ORM batching, query optimization |\n| 26 | Performance | Blocking I/O, CPU-bound operations |\n| 27 | Dependencies | Known CVEs, outdated packages |\n| 33 | Unused Dependencies | Dead code, bundle bloat |\n| 36 | BCDR | Backup, disaster recovery |\n| 37 | Monitoring | Observability, alerting gaps |\n\n---\n\n## How It Works\n\nSnitch is a skill file (`SKILL.md`) — no runtime, no build step, no dependencies. It guides AI assistants through structured security analysis with built-in anti-hallucination rules:\n\n1. **Read** the actual source files before reporting\n2. **Verify** each finding with exact file path and line number\n3. **Check context** — is there a fix nearby? Is this test code? Server or client?\n4. **Prove it** — no evidence, no finding\n\n---\n\n## Contributing\n\nSee [CONTRIBUTING.md](.github/CONTRIBUTING.md) for guidelines.\n\n## License\n\n[MIT](LICENSE)\n",
  "bytes": 6330,
  "sha": "2f51be8320144979de52af7af092b7fbcd4456564c871eb41a7a470723b2673f",
  "repo_slug": "jf10r/snitch",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_jf10r_snitch_72937f39/readme"
}