Agent Skills › abbudjoe/guardtower › guardtower

guardtower

GitHub

用于运行和维护 Guardtower 每日安全暴露扫描器，支持本地项目与部署漏洞扫描、监控面更新及报告检查。

plugins/guardtower/skills/guardtower/SKILL.md abbudjoe/guardtower

Trigger Scenarios

运行每日漏洞暴露扫描更新监控的安全面检查扫描报告

Install

npx skills add abbudjoe/guardtower --skill guardtower -g -y

More Options

Non-standard path

npx skills add https://github.com/abbudjoe/guardtower/tree/main/plugins/guardtower/skills/guardtower -g -y

Use without installing

npx skills use abbudjoe/guardtower@guardtower

指定 Agent (Claude Code)

npx skills add abbudjoe/guardtower --skill guardtower -a claude-code -g -y

安装 repo 全部 skill

npx skills add abbudjoe/guardtower --all -g -y

预览 repo 内 skill

npx skills add abbudjoe/guardtower --list

SKILL.md

Frontmatter

{
    "name": "guardtower",
    "description": "Run or maintain the Guardtower daily security exposure scanner for local projects and deployments."
}

Guardtower

Use this skill when the user asks to run the daily vulnerability exposure scan, update the watched security surfaces, or inspect reports produced by this plugin.

Commands

Run the scanner:

python3 /Users/joseph/guard/plugins/guardtower/scripts/guardtower.py --config /Users/joseph/guard/plugins/guardtower/config.json

Run without network calls for parser smoke tests:

python3 /Users/joseph/guard/plugins/guardtower/scripts/guardtower.py --config /Users/joseph/guard/plugins/guardtower/config.json --no-network

Operating Contract

Treat config.json as the explicit contract for scan roots, watched surfaces, and intelligence sources.
Load credentials through the configured env_file before judging source availability. The default config points at /Users/joseph/guard/.env; do not conclude X_BEARER_TOKEN or VERCEL_TOKEN is missing only because it is absent from the worker shell.
Add new package/product aliases to watched_surfaces; do not bury important matching behavior in prose.
X search is optional and requires X_BEARER_TOKEN.
Reports live under /Users/joseph/.codex/guardtower/reports.
The scanner reads local manifests and public vulnerability sources. It must not mutate cloud jobs or paid compute.