{
  "markdown": "<p align=\"center\">\n  <img src=\"assets/banner.svg\" width=\"800\" alt=\"ShieldCode\">\n</p>\n\n<p align=\"center\">\n  <strong>Stop shipping vulnerable code</strong><br>\n  <sub>Security hardening and production-grade error handling expertise for Claude Code</sub>\n</p>\n\n<p align=\"center\">\n  > **Nota:** ShieldCode é uma skill do Claude Code, não um pacote npm ou pip.\n</p>\n\n<p align=\"center\">\n  <a href=\"#install\">Install</a> ·\n  <a href=\"#what-it-covers\">Coverage</a> ·\n  <a href=\"#before--after\">Examples</a> ·\n  <a href=\"#how-it-works\">How it Works</a>\n</p>\n\n<p align=\"center\">\n  <img src=\"https://img.shields.io/github/stars/nikolasdehor/shieldcode?style=flat-square&labelColor=09090b&color=10b981\" alt=\"Stars\">\n  <img src=\"https://img.shields.io/badge/license-MIT-10b981?style=flat-square&labelColor=09090b\" alt=\"License\">\n  <img src=\"https://img.shields.io/badge/Claude_Code-compatible-06b6d4?style=flat-square&labelColor=09090b\" alt=\"Claude Code compatible\">\n  <img src=\"https://img.shields.io/badge/OWASP-Top_10-10b981?style=flat-square&labelColor=09090b\" alt=\"OWASP Top 10\">\n</p>\n\n---\n\n## The Problem\n\n**62% of AI-generated code contains at least one security vulnerability.**\n\n45% fail OWASP Top 10 checks. Error handling gaps are 2x more common in AI code than in human-written code. Claude is excellent at writing code fast - but without active guidance, it takes shortcuts: concatenating user input into SQL queries, using `MD5` for passwords, swallowing exceptions silently, leaking stack traces to clients.\n\nShieldCode fixes this by giving Claude a set of non-negotiable rules that activate automatically whenever it touches user input, authentication, databases, APIs, file operations, or error handling.\n\n---\n\n## What It Covers\n\n**Security (8 rules):**\n\n| Rule | What it enforces |\n|---|---|\n| Input Validation | Allowlist patterns, type/length/format/range checks |\n| SQL Injection Prevention | Parameterized queries only - no string concatenation |\n| XSS Prevention | Safe DOM APIs, Content Security Policy, template autoescape |\n| Authentication | bcrypt/argon2 only, full JWT verification, rate limiting, secure cookies |\n| Authorization | Server-side role checks, resource ownership validation |\n| Secrets Management | Environment variables only - no hardcoded keys, no secret logging |\n| File Security | Path traversal prevention, upload type/size restrictions |\n| Dependency Safety | Only real, known packages (slopsquatting prevention) |\n\n**Error Handling (6 rules):**\n\n| Rule | What it enforces |\n|---|---|\n| Exception Hierarchy | Typed error classes - no raw `Error` throws |\n| HTTP Status Codes | Correct 400/401/403/404/409/422/429/500 usage |\n| Secure Logging | Structured JSON with correlation IDs, no PII or secrets |\n| Retry with Backoff | Exponential backoff + jitter on all external calls |\n| Circuit Breaker | Fail fast, recover gracefully |\n| Async Error Safety | Handled promises, no unhandled rejections |\n\n---\n\n## Before / After\n\nEvery rule includes concrete UNSAFE vs SAFE examples in TypeScript and Python.\n\n**SQL Injection**\n\n```javascript\n// UNSAFE\ndb.query(`SELECT * FROM users WHERE id = '${id}'`);\n```\n\n```javascript\n// SAFE\ndb.query('SELECT * FROM users WHERE id = $1', [id]);\n```\n\n**Password Hashing**\n\n```javascript\n// UNSAFE\nconst hash = crypto.createHash('md5').update(password).digest('hex');\n```\n\n```javascript\n// SAFE\nconst hash = await bcrypt.hash(password, 12);\n```\n\n**Error Leakage**\n\n```javascript\n// UNSAFE\nres.status(500).json({ error: err.stack });\n```\n\n```javascript\n// SAFE\nlogger.error({ correlationId, err });\nres.status(500).json({ error: 'Internal server error', correlationId });\n```\n\n---\n\n## How it Works\n\n1. Install ShieldCode (one command)\n2. Write code normally\n3. Claude automatically follows secure patterns\n4. Ship secure code every time\n\nShieldCode is a knowledge skill - a `SKILL.md` file that Claude Code loads from `~/.claude/skills/shieldcode/`. No tools. No scripts. No external calls. Pure guidance that shapes Claude's output at the source.\n\n---\n\n## Install\n\n```bash\ncurl -fsSL https://raw.githubusercontent.com/nikolasdehor/shieldcode/main/install.sh | bash\n```\n\n```bash\n# Claude Code plugin\nclaude plugins install github:nikolasdehor/shieldcode\n```\n\n```bash\n# Manual\nmkdir -p ~/.claude/skills/shieldcode\ncurl -o ~/.claude/skills/shieldcode/SKILL.md \\\n  https://raw.githubusercontent.com/nikolasdehor/shieldcode/main/skills/shieldcode/SKILL.md\n```\n\nAfter installing, **restart Claude Code**. The skill activates automatically on security-sensitive code.\n\n---\n\n## Requirements\n\n- **Claude Code** - any plan (Free, Pro, Teams)\n- That's it. Zero dependencies.\n\n---\n\n## Roadmap\n\n- [x] v1.0 - OWASP Top 10 + Error Handling (current)\n- [ ] v1.1 - CSRF protection, rate limiting patterns\n- [ ] v1.2 - Database design security patterns\n- [ ] v2.0 - Auto-scan mode (detect vulnerabilities in existing code)\n\n---\n\n## License\n\nMIT - see [LICENSE](LICENSE)\n\n---\n\n<p align=\"center\">\n  Built by <a href=\"https://github.com/nikolasdehor\">Nikolas de Hor</a>\n  <br>\n  <sub>Because 62% is not acceptable</sub>\n</p>\n",
  "bytes": 5070,
  "sha": "48b769658d2a2a8f735694846b473475532876d979e508be42c439f6de9cbc07",
  "repo_slug": "nikolasdehor/shieldcode",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_nikolasdehor_shieldcode_shieldcode_5d79a3e9/readme"
}