shkSecurity Harness Kit

DocsGetting started

Quick Start

Create a policy, scan a project, mask a prompt, encrypt .env files, and install Git and AI tool hooks in a few minutes.

On this page

This page walks through the most common shk workflows. It assumes the CLI is already installed; see Installation if not.

1. Create a project policy

Create a project policy file:

shk init
bash

This writes shk.toml in the current directory. Read-only commands work without it, but commands that write files or tool configuration require a project policy. When package.json is present, shk init can also apply package-manager supply-chain hardening such as ignore-scripts=true and release age gates; pass --no-npm-hardening to skip that step.

For a stricter starting point that fails on medium-severity findings:

shk init --strict
bash

2. Scan the project

Scan the current project:

shk scan .
bash

Output a machine-readable report:

shk scan . --json
bash

Scan only staged files, or only files changed relative to a base branch:

shk scan --staged
shk scan . --changed-since origin/main
bash

See shk scan for Git history scanning, SARIF output, and exit code semantics.

3. Mask content before sharing it with AI

Mask sensitive content from stdin:

shk mask < prompt.txt
bash

Mask an Office document into a new file:

shk mask report.docx --output report.redacted.docx
bash

Scan or mask the clipboard directly:

shk clipboard scan
shk clipboard mask --write
bash

4. Encrypt .env files

Encrypt a .env file in place and run a command with decrypted values injected only at runtime:

shk env encrypt .env --in-place
shk env run -- npm test
bash

Private keys are stored in the OS keyring by default. Teams can opt in to 1Password; see Env Secret Store.

5. Install hooks

Install a Git pre-commit hook that scans staged files:

shk hooks install
bash

Install AI tool hooks in audit mode to observe without blocking:

shk hooks install-ai --audit
bash

Install AI tool hooks that block but keep metadata-only block logs, then review them:

shk hooks install-ai --log-blocked
shk audit
bash

Hooks are supported for Claude Code, Cursor, Codex, GitHub Copilot, Antigravity, and Windsurf. See shk hooks install-ai for tool-specific options.

6. Add CI

Generate a GitHub Actions workflow that scans every pull request:

shk ci init github
# Add GitHub code scanning alerts and PR annotations:
shk ci init github --upload-sarif
bash

Alternatively, use the repository's composite action after checkout on a Linux or macOS runner:

permissions:
  contents: read
  security-events: write

steps:
  - uses: actions/checkout@v7
    with:
      persist-credentials: false
  - uses: Kazuki-tam/security-harness-kit@v1
    with:
      path: .
      fail-on: high
      upload-sarif: true
yaml

See GitHub Actions for modes, pinning, and troubleshooting.

7. Install the agent skill and check coverage

Install the shk agent skill for Claude Code, Codex, Cursor, Copilot, Antigravity, and Windsurf:

shk skills install
bash

Check ignore coverage:

shk doctor ignore
bash

Common commands at a glance

shk init
shk init --strict
shk init --yes --no-npm-hardening

shk scan .
shk scan . --json
shk scan . --json --with-value-hash
shk scan . --sarif
shk scan --staged
shk scan . --changed-since origin/main
shk scan --git-history
shk scan --git-history --preview
shk scan --git-history --ref HEAD~50..HEAD
shk allowlist suggest --from report-with-hashes.json --value-hash

shk mask < prompt.txt
shk mask --json < prompt.txt
shk mask report.docx --output report.redacted.docx
shk mask orders.csv --pseudonymize --columns "Email:email,Phone:phone" --output orders.pseudo.csv
shk pseudonymize key show

shk clipboard scan
shk clipboard mask
shk clipboard mask --write

shk doctor
shk doctor --strict
shk doctor ignore --fix
shk doctor env --dotenvx
shk doctor workflows --fix

shk audit
shk audit --reason action-guard
shk audit --since 7d --tool cursor
shk audit --json

shk mcp audit
shk mcp audit --json
shk mcp audit --sarif
shk mcp audit --global

shk env dotenvx import-keys .env.keys
shk env encrypt .env --in-place
shk env run -- npm test
shk env key import
shk env key list
shk env key delete --env staging
shk env key export --instructions
shk env key migrate --to 1password
shk env decrypt .env --output .env.local
shk secrets push --profile prod --dry-run

shk hooks install
shk hooks install-ai --dry-run
shk hooks install-ai --audit
shk hooks install-ai --log-blocked
shk hooks install-ai --tool copilot
shk hooks install-ai --tool antigravity
shk hooks install-ai --tool windsurf

shk ci init github
shk ci init github --upload-sarif
shk ci init github --dry-run
shk ci init github --mode audit
shk ci init github --shk-version v0.7.0

shk skills install
shk skills install --tool claude-code --global
shk skills install --tool windsurf
shk skills status
bash