shkSecurity Harness Kit

DocsGetting started

Quick Start

Create a policy, scan a project, mask a prompt, encrypt .env files, and install Git and AI tool hooks in a few minutes.

On this page

This page walks through the most common shk workflows. It assumes the CLI is already installed; see Installation if not.

  1. 1. Configureshk init
  2. 2. Inspectshk scan .
  3. 3. ProtectGit / AI hooks + CI

Start with steps 1–2 to verify scanning, then add masking, encryption, and hooks for your workflow.

1. Create a project policy

Create a project policy file:

shk init
bash

This writes shk.toml in the current directory. Read-only commands work without it, but commands that write files or tool configuration require a project policy. When package.json is present, shk init can also apply package-manager supply-chain hardening such as ignore-scripts=true and release age gates; pass --no-npm-hardening to skip that step.

For a stricter starting point that fails on medium-severity findings:

shk init --strict
bash

2. Scan the project

Scan the current project:

shk scan .
bash

Output a machine-readable report:

shk scan . --json
bash

Scan only staged files, or only files changed relative to a base branch:

shk scan --staged
shk scan . --changed-since origin/main
bash

See shk scan for Git history scanning, SARIF output, and exit code semantics.

3. Mask content before sharing it with AI

Mask sensitive content from stdin:

shk mask < prompt.txt
bash

Mask an Office document into a new file:

shk mask report.docx --output report.redacted.docx
bash

Scan or mask the clipboard directly:

shk clipboard scan
shk clipboard mask --write
bash

4. Encrypt .env files

Encrypt a .env file in place and run a command with decrypted values injected only at runtime:

shk env encrypt .env --in-place
shk env run -- npm test
bash

Private keys are stored in the OS keyring by default. Teams can opt in to 1Password; see Env Secret Store.

5. Install hooks

Install a Git pre-commit hook that scans staged files:

shk hooks install
bash

Install AI tool hooks in audit mode to observe without blocking:

shk hooks install-ai --audit
bash

Install AI tool hooks that block but keep metadata-only block logs, then review them:

shk hooks install-ai --log-blocked
shk audit
bash

Hooks are supported for Claude Code, Cursor, Codex, GitHub Copilot, Antigravity, Grok Build, and Windsurf. See shk hooks install-ai for tool-specific options.

6. Add CI

Generate a GitHub Actions workflow that scans every pull request:

shk ci init github
# Add GitHub code scanning alerts and PR annotations:
shk ci init github --upload-sarif
bash

Alternatively, use the repository's composite action after checkout on a Linux or macOS runner:

permissions:
  contents: read
  security-events: write

steps:
  - uses: actions/checkout@v7
    with:
      persist-credentials: false
  - uses: Kazuki-tam/security-harness-kit@v1
    with:
      path: .
      fail-on: high
      upload-sarif: true
yaml

See GitHub Actions for modes, pinning, and troubleshooting.

7. Install the agent skill and check coverage

Install the shk agent skill for Claude Code, Codex, Cursor, Copilot, Antigravity, Grok Build, and Windsurf:

shk skills install
bash

Check ignore coverage:

shk doctor ignore
bash

Common commands at a glance

Goal Starting command Details
Create policy shk init init
Scan shk scan . scan
Mask before sharing shk mask < prompt.txt mask
Pseudonymize a table shk mask orders.csv --pseudonymize --columns "Email:email" --output orders.pseudo.csv mask
Check protection shk doctor doctor
Review blocks shk audit audit
Audit MCP config shk mcp audit mcp audit
Run with encrypted env shk env run -- npm test env
Install AI hooks shk hooks install-ai --log-blocked hooks
Add CI shk ci init github CI
Install skills shk skills install skills