Setup

Security Setup

Inspect scanner availability and help the user install missing tools. Do not install anything without explicit user approval.

Step 1: Detect Current State

Run:

"${CLAUDE_PLUGIN_ROOT}/scripts/detect-tools.sh"

Display:

Show the coverage estimate from the script.

Step 2: Recommend Tools

Recommendations:

• Always recommend semgrep.
• Recommend gitleaks for any repository with git history.
• Recommend trivy when Dockerfile, lockfiles, IaC, or container usage is detected.
• Recommend bandit only for Python projects.
• Recommend gosec only for Go projects.

Step 3: Show Install Commands

Prefer isolated/user-scoped installers where practical:

semgrep

# macOS
brew install semgrep

# Isolated Python tool install
pipx install semgrep

# uv
uv tool install semgrep

gitleaks

brew install gitleaks
go install github.com/gitleaks/gitleaks/v8@latest

trivy

brew install trivy
# Linux packages: https://aquasecurity.github.io/trivy/latest/getting-started/installation/

bandit

pipx install bandit
uv tool install bandit

gosec

go install github.com/securego/gosec/v2/cmd/gosec@latest
brew install gosec

Avoid global pip install unless the user explicitly chooses it.

Step 4: Ask Before Installing

Ask which missing tools to install. Include a "show commands only" option. If the user chooses installation, run only the selected commands and explain any command that needs elevated privileges before running it.

If no supported installer is available, print manual instructions and do not attempt workarounds.

Step 5: Verify

Run:

"${CLAUDE_PLUGIN_ROOT}/scripts/detect-tools.sh"

Display updated coverage and next step:

Run /security:baseline to create the project profile, then /security:scan.

Begin by detecting current state.