Agent Skills › abbudjoe/guardtower › guardtower

guardtower

GitHub

用于运行或维护 Guardtower 每日安全暴露扫描器，支持本地项目与部署的漏洞扫描、监控表面更新及报告检查。

plugins/guardtower/skills/guardtower/SKILL.md abbudjoe/guardtower

触发场景

运行每日漏洞暴露扫描更新受监控的安全面检查生成的扫描报告

安装

npx skills add abbudjoe/guardtower --skill guardtower -g -y

更多选项

非标准路径

npx skills add https://github.com/abbudjoe/guardtower/tree/main/plugins/guardtower/skills/guardtower -g -y

不安装直接使用

npx skills use abbudjoe/guardtower@guardtower

指定 Agent (Claude Code)

npx skills add abbudjoe/guardtower --skill guardtower -a claude-code -g -y

安装 repo 全部 skill

npx skills add abbudjoe/guardtower --all -g -y

预览 repo 内 skill

npx skills add abbudjoe/guardtower --list

SKILL.md

Frontmatter

{
    "name": "guardtower",
    "description": "Run or maintain the Guardtower daily security exposure scanner for local projects and deployments."
}

Guardtower

Use this skill when the user asks to run the daily vulnerability exposure scan, update the watched security surfaces, or inspect reports produced by this plugin.

Commands

Run the scanner:

python3 /Users/joseph/guard/plugins/guardtower/scripts/guardtower.py --config /Users/joseph/guard/plugins/guardtower/config.json

Run without network calls for parser smoke tests:

python3 /Users/joseph/guard/plugins/guardtower/scripts/guardtower.py --config /Users/joseph/guard/plugins/guardtower/config.json --no-network

Operating Contract

Treat config.json as the explicit contract for scan roots, watched surfaces, and intelligence sources.
Load credentials through the configured env_file before judging source availability. The default config points at /Users/joseph/guard/.env; do not conclude X_BEARER_TOKEN or VERCEL_TOKEN is missing only because it is absent from the worker shell.
Add new package/product aliases to watched_surfaces; do not bury important matching behavior in prose.
X search is optional and requires X_BEARER_TOKEN.
Reports live under /Users/joseph/.codex/guardtower/reports.
The scanner reads local manifests and public vulnerability sources. It must not mutate cloud jobs or paid compute.