# Ship Safe Red Team

> Run a multi-agent red team scan — 16 specialized security agents scan for 80+ attack classes including injection, auth bypass, SSRF, supply chain, Supabase RLS, MCP security, agentic AI, RAG poisoning, PII compliance, and more. Use when the user wants a deep security analysis beyond just secrets. Use when this capability is needed.

- Skill: `tomevault-io/ship-safe-red-team` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/ship-safe-red-team`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/ship-safe-red-team/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/ship-safe-red-team

---


# Ship Safe — Red Team Scan

You are running a multi-agent red team scan using Ship Safe's 13 security agents.

## Step 1: Run the red team scan

```bash
npx ship-safe@latest red-team $ARGUMENTS --json --no-ai 2>/dev/null
```

If `$ARGUMENTS` is empty, default to `.`:

```bash
npx ship-safe@latest red-team . --json --no-ai 2>/dev/null
```

If the user wants specific agents only, use the `--agents` flag:

```bash
npx ship-safe@latest red-team . --agents injection,auth,ssrf --json --no-ai 2>/dev/null
```

Available agents: `injection`, `auth`, `ssrf`, `supply-chain`, `config`, `llm`, `mobile`, `git-history`, `cicd`, `api`, `supabase-rls`

## Step 2: Parse and present results

The JSON output contains findings from each agent. Present results grouped by agent:

### For each agent that found issues:
1. **Agent name and category** (e.g., "InjectionTester — Code Vulnerabilities")
2. **Finding count** by severity
3. **Top findings** — list critical and high severity findings with:
   - File and line number
   - Rule name and description
   - Code context (if available, show the flagged line with surrounding lines)
   - Suggested fix
   - Confidence level

### Agent summary table
Show a table: Agent | Findings | Critical | High | Medium

### Agents with zero findings
List them briefly as clean — this is useful context.

## Step 3: Deep dive and remediation

For the most critical findings:
1. Read the actual source file for full context
2. Explain the vulnerability in plain language — what could an attacker do?
3. Offer to fix it with a concrete code change
4. After fixing, offer to re-run just that agent to verify: `npx ship-safe@latest red-team . --agents <agent>`

## Step 4: Recommendations

Based on the results, suggest:
- Which agents to focus on (highest finding count or most critical findings)
- Whether to create a baseline (`/ship-safe-baseline`) for the current state
- Framework-specific hardening tips based on detected stack (from recon agent)

## Important Notes

- The 13 agents are: InjectionTester, AuthBypassAgent, SSRFProber, SupplyChainAudit, ConfigAuditor, SupabaseRLSAgent, LLMRedTeam, MobileScanner, GitHistoryScanner, CICDScanner, APIFuzzer, ReconAgent, ScoringEngine
- Agents run in parallel — the scan should complete in under 60 seconds for most projects
- Low-confidence findings in test files or documentation are likely false positives
- Never display actual secret values

---
> Source: [asamassekou10/ship-safe](https://github.com/asamassekou10/ship-safe) — distributed by [TomeVault](https://tomevault.io).
<!-- tomevault:4.0:skill_md:2026-06-19 -->