agentshield - AI agent security scanner. Detect vulnerabilities

项目说明

<di="center">

<img src="./assets/agentshield-logo.png" alt="AgentShield" width="180" />

AgentShield

Security auditor for AI agent configurations

Scans Claude Code setups for hardcoded secrets, permission misconfigs,<br/>
hook injection, MCP ser, and agent prompt injection .<br/>
A as CLI, GitHub Action, and GitHub App integration.

![npm ]()
![npm downloads]()
![tests]()
![co]()

Quick Start · What It Catches · API Reference · Opus Pipeline · GitHub Action · Distribution · MiniClaw · Changelog

<a href="
<img src="./assets/ito.svg" alt="Itô Markets" width="180" />
</a>
<br />
_{<strong>Preferred compute sponsor:</strong> Run or self-host any open-source model. Itô is ECC's suggested compute provider. Any GPU provider works. ECC only links to the Itô dashboard for sign-in and GPU rental or management; it does not create or manage rentals or pro compute or serving. Managed inference through Itô is not live yet.}

</div>

---

Why

The AI agent ecosystem is growing faster than its security tooling. In January 2026 alone:

De install community skills, connect MCP servers, and configure hooks without any automated way to audit the security of their setup. AgentShield scans your .claude/ directory and flags before they become exploits.

Built at the Claude Code Hackathon (Cerebral x Anthropic, Feb 2026). Part of the E Claude Code ecosystem (42K+ stars).

Quick Start

That's it. AgentShield auto-discovers your ~/.claude/ directory, scans all config files, and prints a graded security report.

Discovery intentionally skips common generated directories such as node_modules, build output, and .dmux worktree mirrors so transient copies do not duplicate findings.

More commands

JSON reports now expose findings[].runtimeConfidence when AgentShield can distinguish acti config from project-local settings, template/example in, installed Claude plugin caches, declarati manifests, and manifest-resol hook implementations. Reports also include local harness adapter e for Claude Code, OpenCode, Codex, Gemini, Zed, VS Code, dmux, terminal-agent wrappers, and project-local templates when matching markers are present.

What It Catches

268 rules across 15 modules, graded A to F with a 0 to 100 numeric score. Recognized defenses are listed and ne.

#### Scoring and recognized defenses

The score starts at 100 per category and only findings deduct from it: critical 25, high 15, medium 5, low 2, info 0. Protecti the scanner finds (deny and ask lists, sandbox settings, blocking PreToolUse hooks, read-only agent tool lists, Codex sandbox_mode, Hermes manual approvals, and similar) is listed in every report under "Recognized Defenses" so it gets credit and is ne. Defenses do not add points either: the score cannot be gamed by adding decorative deny rules, it can only be lowered by real findings. Guard-pattern findings the permission rules emit at info se ("Deny/ask rule blocking ...", "Prohibition of ...", "Mention of ...") are enforced to a zero deduction in src/reporter/score.ts.

Secrets Detection

| What | Examples |
|------|----------|
| API keys | Anthropic (sk-ant-), OpenAI (sk-proj-/sk-), xAI (xai-), AWS (AKIA), Google/Gemini (AIza), Stripe (sk_test_/sk_live_) |
| Tokens | GitHub PATs (ghp_/github_pat_), Linear (lin_api_), Cloudflare (CF_API_TOKEN=), Slack (xox[bprs]-), JWTs (eyJ...), Bearer tokens |
| Credentials | Hardcoded passwords, database connection strings (postgres/mongo/mysql/redis), private key material |
| En | Secrets passed through en in configs, echo $SECRET in hooks |

Permission Audit (17 rules)

| What | Examples |
|------|----------|
| Wildcard access | Bash(*), Write(*), Edit(*) — unrestricted tool permissions |
| Missing deny lists | No deny rules for rm -rf, sudo, chmod 777 |
| Dangerous flags | --dangerously-skip-permissions usage |
| Mutable tool exposure | All mutable tools (Write, Edit, Bash) allowed without scoping |
| Destructive git | git push --force, git reset --hard in allowed commands |
| Unrestricted network | curl *, wget, ssh *, scp * in allow list without scope |

Hook Analysis (40 rules)

| What | Examples |
|------|----------|
| Command injection | ${file} interpolation in shell commands — attacker-controlled filenames become code |
| Data exfiltration | curl -X POST with interpolation sending data to external URLs |
| Silent errors | 2>/dev/null, \|\| true — failing security hooks that silently pass |
| Missing hooks | No PreToolUse hooks, no Stop hooks for session-end |
| Network exposure | Unthrottled network requests in hooks, sensitive file access without filtering |
| Session startup | SessionStart hooks that download and execute remote scripts |
| Package installs | Global npm install -g, pip install, gem install, cargo install in hooks |
| Container escape | Docker --pri, --pid=host, --network=host, root mounts |
| Credential access | macOS Keychain, GNOME Keyring, /etc/shadow reads |
| Reverse shells | /dev/tcp, mkfifo + nc, Python/Perl socket shells |
| Clipboard access | pbcopy, xclip, xsel, wl-copy — exfiltration |
| Log tampering | journalctl --, rm /var/log, history -c — anti-forensics |

MCP Ser (49 rules)

| What | Examples |
|------|----------|
| High-risk servers | Shell/command MCPs, filesystem with root access, database MCPs, browser automation |
| Supply chain | npx -y auto-install without confirmation — typosquatting |
| Hardcoded secrets | API tokens in MCP en config instead of env |
| Remote transport | MCP servers connecting to remote URLs (SSE/streamable HTTP) |
| Shell metacharacters | &&, \|, ; in MCP ser arguments |
| Missing metadata | No pin, no description, excessi count |
| Sensitive file args | .env, .pem, credentials.json passed as ser |
| Network exposure | Binding to 0.0.0.0 instead of localhost |
| Auto-approve | autoApprove settings that skip user confirmation for tool calls |
| Missing timeouts | High-risk servers without timeout — resource exhaustion risk |

Supply-chain (agentshield scan --supply-chain) extracts MCP
package references plus root package.json and package-lock.json dependency
e, then reports pro counts for npm vs git, pinned ,
known-good packages, and npm-registry-backed metadata. Add
--supply-chain-online to query npm for downloads, maintainers, postinstall
scripts, deprecation, and package age.

Package-manager hardening checks also scan .npmrc, .yarnrc.yml, and
pnpm-workspace.yaml for plaintext registry credentials, explicit dependency
lifecycle-script enablement, and missing or weak release-age cooldowns where the
package manager supports them. npm configs are checked for lifecycle-script
blocking and unsupported release-age keys that can create false confidence; use
pnpm minimumReleaseAge / minimum-release-age, Yarn npmMinimalAgeGate, or an
external package-manager policy wrapper for cooldown enforcement.

AgentShield also scans AI de persistence surfaces used by recent npm
and PyPI campaign payloads, including Claude Code hook settings,
.claude/router_runtime.js, VS Code tasks.json folder-open automation,
Zed project tasks.json, ./setup.mjs, .zed/setup.mjs, GitHub
workflow drop-ins, LaunchAgent/systemd dead-man switch artifacts,
gh-token-monitor token-store files, metadata-service credential targets, and
reported exfiltration or second-stage network indicators. These indicators are
emitted as critical hook findings so CI can fail fast e the malicious
package has been uninstalled.

#### MCP Confidence Notes

AgentShield scans both active MCP config and repository-shipped MCP templates.

Agent Config Review (41 rules)

| What | Examples |
|------|----------|
| Unrestricted tools | Agents with Bash access, no allowedTools restriction |
| Prompt injection surface | Agents processing external/user-provided content without defenses |
| Auto-run instructions | CLAUDE.md containing "Always run", "without asking", "automatically install" |
| Hidden instructions | Unicode zero-width characters, HTML comments, base64-encoded directives |
| URL execution | CLAUDE.md instructing agents to fetch and execute remote URLs |
| Time bombs | Delayed execution instructions triggered by time or absence conditions |
| Data har | Bulk collection of passwords, credentials, or database dumps |
| Prompt reflection | ignore previous instructions, you are now, DAN jailbreak, fake system prompts |
| Output manipulation | always report ok, remo from output, suppress security findings |

Structured JSON under .claude/subagents/ and .claude/slash-commands/ is analyzed like agent config when it declares allowedTools or similar tool metadata. Slash commands under commands/ and slash-commands/ are typed command-md: they get the injection and dangerous-instruction rules but not the skill packaging hygiene rules, which only apply to SKILL.md. Freeform skill-md prompt text still has narrower security co than agent-md and CLAUDE.md.

#### Scanner Accuracy Notes

#### False-Positi Workflow

Use this workflow when a repo scan looks noisy or when you are tuning AgentShield rules.

1. Start with JSON output so you can inspect file paths, runtimeConfidence, and score impact directly.
2. Separate acti findings from lower-confidence source kinds before changing any rules.
3. suspected false positi at least one real repo and one minimal synthetic fixture.
4. Prefer source-aware reclassification and wording changes before adding blanket suppression.
5. Keep real secrets and explicit execution paths e examples, manifests, or templates.
6. Re-run targeted tests, then the full gate, before changing release behavior.

Recommended commands:

Confidence-first triage commands:

Recommended audit order:


Rule-design guidelines:


When you change rule accuracy, update both:


#### Reducing False Positives In Practice

The current scan profile is not dominated by broken matchers. It is mostly dominated by lower-confidence source kinds that need different interpretation.

Current patterns from the latest li:


Recommended operating model:


Features

Auto-Fix Engine (--fix)

Automatically applies safe fixes:


Only fixes marked auto: true are applied. Permission changes require human review.

: --fix does not trust itself. After applying fixes it re-scans the target, and if the posture score regressed or a new high/critical finding appeared (the kind of churn a nai tighten can cause), it rolls every modified file back to its original content. On success it prints a tamper-e attestation digest binding the before/after score and finding deltas, so the kept fixes are provably non-regressing.

External Rule Packs (--rule-pack)

Run community or private detection rules alongside the built-ins, without recompiling:

A pack is a JSON file with the same fail-closed approach as --policy (bad JSON, schema , duplicate ids, or an uncompilable regex abort the scan):

Each pattern is a JS regex run against file content; fileTypes is optional and scopes a rule to specific config types. External findings count toward the o grade. Anyone with a pack in this shape can plug in.

Secure Init (agentshield init)

Generates a hardened .claude/ directory with scoped permissions, safety hooks, and security best practices. Existing files are ne.

Claude Opus Deep Analysis (--opus)

Three-agent ad pipeline powered by Claude Opus (claude-opus-5 by default; the injection tester uses claude-sonnet-5):

1. Red Team (Attacker) — finds exploitable attack and multi-step chains
2. Blue Team (Defender) — e existing protections and recommends hardening
3. Auditor — synthesizes both perspectives into a prioritized risk assessment

The Attacker finds that curl hooks with ${file} interpolation + Bash(*) = command injection pivot. The Defender notes no PreToolUse hooks exist to stop it. The Auditor chains them into a prioritized action list.

Requires ANTHROPIC_API_KEY en .

#### OrcaRouter provider

The --opus and --injection analysis modes can also run through
OrcaRouter, an OpenAI/Anthropic-compatible gateway
that routes each request to the most cost-effecti model:

The provider points the Anthropic client at and
uses the gateway's namespaced model ids (e.g. anthropic/claude-sonnet-5,
anthropic/claude-opus-5). The default provider remains Anthropic.

With --provider orcarouter the scanned configuration contents are sent to
OrcaRouter's API instead of Anthropic's, so do not use it on configs containing
secrets you have not redacted.

Compliance Mapping (--compliance)

Map findings to audit-framework control IDs so GRC teams get an auditor-ready co artifact instead of a raw findings list:

Each framework prints a control-co table (control id, title, highest se, finding count, examples), ordered by se:

Mapping is finding-category-le (SOC 2, PCI DSS v4.0, ISO/IEC 27001:2022 Annex A), not a certified crosswalk; confirm control applicability with your auditor.

Output Formats

| Format | Flag | Use Case |
|--------|------|----------|
| Terminal | --format terminal (default) | Interactive use |
| JSON | --format json | CI pipelines, programmatic access |
| Markdown | --format markdown | Documentation, PRs |
| HTML | --format html | Executi with risk posture and priorities |
| E pack | --e <dir> | Audit and buyer reviews |
| Remediation plan | --remediation-plan <path> | Stable-fingerprint fix queue for CI and ticketing |

E packs write a deterministic directory containing manifest.json,
README.md, agentshield-report.json, agentshield-report.html,
agentshield-results.sarif, policy-e.json,
baseline-comparison.json, supply-chain.json, and
ci-context.json, and remediation-plan.json. The manifest records SHA-256
digests and byte counts for bundle artifacts plus a bundle digest over the
machine-readable e. ci-context.json records whitelisted GitHub Actions
workflow, commit, run, and runner pro without copying arbitrary
en into the bundle.
Redaction is enabled by default for local paths, usernames, emails, and
token-shaped strings; use --no-e only for private internal
bundles.

Remediation plans write a JSON queue of findings with stable hashed
fingerprints, se, file, fixability, ordered workflow phases, and the
recommended next command. The workflow phases route safe auto-fixes first,
manual-review findings second, and last so maintainers can attach
the plan to CI tickets without turning every finding into a separate thread.
They intentionally omit raw e and fix before/after so teams can
attach the plan to tickets without copying token-shaped strings.

a sa pack before attaching it to CI artifacts or customer
handoffs:

Inspect a e pack when a downstream GitHub App, Linear sync, or
security-review workflow needs a compact readback without opening every artifact:

Aggregate multiple e packs when an operator needs fleet-level
routing across repos, teams, or harnesses. The JSON output includes
operatorReadback for promotion status/digest checks and re with
source e paths and owner-ready recommendations for packs that need
follow-up:

operatorReadback is the stable field for downstream GitHub App, Linear, or
ECC Tools routing. It reports ready, status, digest, owner counts,
blocking review counts, appro, deterministic appro, and the
next operator action so fleet promotion can be gated without parsing terminal
prose. Each review item also carries the same approvalId plus a
Linear-friendly ticket externalId, allowing sync jobs to dedupe owner approval
threads across reruns.

JSON Report Shape

agentshield scan --format json is the supported machine-readable scanner interface today.

Notes:


API Reference

AgentShield currently has three distinct automation surfaces:

Important packaging note:


Detailed request/response and schema notes live in API.md.

GitHub Action

Inputs:

| Input | Default | Description |
|-------|---------|-------------|
| path | . | Path to scan |
| min-se | medium | Minimum se: critical, high, medium, low, info |
| fail-on-findings | true | Fail the action if findings meet se threshold |
| format | terminal | Output format: terminal, json, markdown, sarif |
| sarif-output | agentshield-results.sarif | SARIF output path when format is sarif |
| baseline | "" | Optional AgentShield baseline JSON path for drift comparison |
| sa | "" | Optional path to write the current scan as a new baseline |
| policy | "" | Optional organization policy JSON path |
| fail-on-policy | true | Fail the action if the organization policy is non-compliant |
| supply-chain | true | MCP npm/git package pro and known malicious package risk |
| supply-chain-online | false | Query npm registry metadata during supply-chain |
| fail-on-supply-chain | follows fail-on-findings | Fail the action when supply-chain finds critical or high package risks |
| e | "" | Optional directory for a portable audit e bundle |
| | true | e artifact hashes after writing |
| policy-promotion-manifest | "" | Optional policy export manifest to and promote or dry-run |
| policy-promotion-pack | "" | Policy pack id when the manifest contains multiple packs |
| policy-promotion-output | .agentshield/policy.json | Acti path to write when promotion dry-run is disabled |
| policy-promotion-dry-run | true | promotion review e without writing the acti |
| fail-on-policy-promotion | false | Fail when promotion review items still require action |

Outputs: score (0–100), grade (A–F), total-findings, critical-count, sarif-path, baseline-path, baseline-status, new-findings, resol, unchanged-findings, score-delta, policy-status, policy-, policy-promotion-status, policy-promotion-pack, policy-promotion-re, policy-promotion-action-required-count, policy-promotion-digest, supply-chain-status, supply-chain-risky-packages, supply-chain-critical-count, supply-chain-high-count, package-manager-hardening-status, package-manager-hardening-findings, package-manager-hardening-critical-count, package-manager-hardening-high-count, package-manager-hardening-registry-credentials, package-manager-hardening-lifecycle-scripts, package-manager-hardening-release-age-gates, e, e, e

The action writes a markdown job summary and emits GitHub annotations inline on affected files. When format: sarif is set, it also writes a SARIF 2.1.0 report that can be uploaded to GitHub code scanning with github/codeql-action/upload-sarif. When baseline is set, the action appends a baseline drift summary, emits regression annotations for new findings, and reports baseline-status as passed, failed, missing, or not-run. When policy is set, the SARIF report includes organization-policy as agentshield-policy/* code-scanning results, appends the organization policy result to the job summary, emits policy annotations, and fails by default unless fail-on-policy: "false" is set. When policy-promotion-manifest is set, the action the selected policy export digest, emits promotion re counts, appends the owner/protected-rollout/runtime-smoke review items to the job summary, and marks runtime smoke as when the same job also scans with the promoted policy. Supply-chain runs offline by default for MCP package references, appends package-risk e to the job summary, writes real supply-chain.json e packs, and fails on critical/high package risk whenever the action is in failing mode unless fail-on-supply-chain: "false" is set. Package-manager hardening outputs and job-summary e separately count plaintext registry credentials, lifecycle-script drift, and release-age gate drift so CI and hosted consumers can route supply-chain configuration risk even when the main finding gate is collecting e only.

Baseline drift gate:

Use fail-on-findings: "false" when the workflow should fail only on drift from the baseline. Keep the default fail-on-findings: "true" when any current finding at or above min-se should still fail the action.

CLI Reference

Report footer CTA: terminal and markdown reports can append a one-line ECC
Tools Pro footer. It is off by default. Set AGENTSHIELD_CTA=1 (or
ECC_CTA=1) to enable it; set AGENTSHIELD_NO_CTA=1 (or ECC_NO_CTA=1) to
hard-suppress it, which wins o. JSON and SARIF output ne
it.

Baseline write:

The baseline command is a first-class wrapper around the existing scan baseline
format. New baselines store stable hashed e fingerprints and omit raw
e , so teams can keep baseline snapshots in CI without copying
token-shaped strings into long-li. Existing raw-e baselines
remain comparable during migration. Use it to create the accepted snapshot,
then compare future scans with
agentshield scan --baseline .github/agentshield-baseline.json --gate.

Runtime monitor lifecycle:

Organization policy files support enterprise metadata and temporary exceptions:

Policy pack presets are starter baselines, not hidden SaaS policy. oss keeps
public repos permissi requiring destructi deny entries;
team adds the runtime hook; enterprise raises score gates and blocks broad
tool allowlists; regulated disallows critical/high findings and bans broader
MCP/tool surfaces; high-risk-hooks-mcp focuses on hook/MCP-hea; and
ci-enforcement is tuned for branch-protection e.

Policy export writes one JSON policy file per selected pack plus a
manifest.json containing SHA-256 digests. This gi teams a stable
artifact bundle for branch-protection review, audit attachment, or downstream
policy promotion without relying on generated console output.

Policy promotion is the review gate for those exported bundles. It reads the
export manifest, the selected policy file digest, the policy
schema, and only then writes the acti path. Use --dry-run --json in
review workflows to prove the exact pack, source file, output path, owner list,
and digest before a protected branch or operator copies the policy into place.
Promotion results also include re for owner approval, protected PR
rollout, and the runtime smoke test needed before enabling an enforcing CI gate.

Policy e now includes an exception lifecycle audit in terminal output
and GitHub Action summaries: total exceptions, acti, exceptions
expiring within seven days, expired exceptions, owners, tickets, scopes, and
days until expiry. This keeps temporary waivers in branch-protection
e instead of letting them become silent permanent bypasses.

Exit codes:


Security Rules Summary

| Category | Rules | Patterns | Se Range |
|----------|-------|----------|----------------|
| Secrets | 10 | 14 | Critical -- Medium |
| Permissions | 10 | -- | Critical -- Medium |
| Hooks | 34 | -- | Critical -- Low |
| MCP Servers | 23 | -- | Critical -- Info |
| Agents | 25 | -- | Critical -- Info |
| Total | 102 | 14 | |

Architecture

MiniClaw

MiniClaw is a minimal, sandboxed AI agent runtime bundled with AgentShield. Where typical agent platforms expose many attack surfaces (single HTTP endpoint backed by an isolated sandbox.

Or use as a library:

MiniClaw-specific package exports and HTTP endpoints are documented in src/miniclaw/README.md and summarized in API.md. The React dashboard source lives in src/miniclaw/dashboard.tsx, but it is not yet published as a separate npm subpath.

Security Model

Four independently enforced layers:

| Method | Endpoint | Description |
|--------|----------|-------------|
| POST | /api/prompt | Send a prompt |
| POST | /api/session | Create a sandboxed session |
| GET | /api/session | Session info |
| DELETE | /api/session/:id | Destroy session + cleanup |
| GET | /api/events/:sessionId | Security audit events |
| GET | /api/health | Health check |

MiniClaw has zero external runtime dependencies — Node.js built-ins only (http, fs, path, crypto). The optional React dashboard requires React 18+ as a peer dependency.


De

Distribution

AgentShield is a through multiple channels:

| Channel | Use Case | Install |
|---------|----------|---------|
| Standalone CLI | Direct scanning from your terminal | npm install -g ecc-agentshield or npx ecc-agentshield scan |
| GitHub Action | Automated security checks on PRs in CI/CD | uses: affaan-m/agentshield@v1 |
| ECC Plugin | Claude Code users via the ECC skill ecosystem | Install through E Claude Code |
| ECC Tools GitHub App | Integrated scanning across your GitHub org | Install at github.com/apps/ecc-tools |
| ECC Tools Pro | GitHub App with automated repo analysis, Stripe billing ($19/seat/mo) | Install |


FAQ

What is AgentShield?

AgentShield is a security auditor for AI agent configurations. It scans Claude Code setups for hardcoded secrets, permission misconfigs, hook injection, MCP ser, and agent prompt injection .

| Feature | Description |
|---------|-------------|
| Security Auditor | Scans .claude/ directory for |
| Multiple Surfaces | CLI, GitHub Action, GitHub App integration |
| Auto-Fix | Replaces hardcoded secrets with env |
| Graded Reports | Security score (0-100) with findings breakdown |
| Opus Pipeline | Three-agent ad analysis with Anthropic API |
| E Pack | Portable audit bundle for compliance |

What can AgentShield detect?

| Category | Examples |
|----------|----------|
| Secrets | Hardcoded API keys, tokens, private keys, connection strings |
| Permissions | Overly permissi rules like Bash(*)` |
| Hooks | Hook injection , unsafe hooks |
| MCP Servers | MCP ser, malicious MCP configs |
| Agents | Agent prompt injection |

How to get started?

Quick Start (no install):

Install globally:

Auto-fix safe issues:

What output formats are a?

| Format | Use Case |
|--------|----------|
| Default | Terminal graded security report |
| JSON | CI pipelines and automation |
| HTML | Executi report |
| E Pack | Portable audit bundle for compliance |

What is the Opus Pipeline?

The Opus Pipeline is a three-agent ad analysis that runs on Claude Opus through the Anthropic API:
1. Attacker: hunts for exploitable weaknesses in the scanned config
2. Defender: proposes concrete hardening for each weakness
3. Auditor: reconciles both views into a ranked risk assessment

Usage:

What is MiniClaw?

MiniClaw is a sandboxed agent runtime included with AgentShield:

Is AgentShield free and open source?

Yes! AgentShield is MIT licensed and free to use. Built at the Claude Code Hackathon (Cerebral x Anthropic, Feb 2026).

How to contribute?

Contributions welcome! Check the repository for issues and pull requests. See CONTRIBUTING.md for guidelines.

Where to get help?

| Resource | Link |
|----------|------|
| Repository | github.com/affaan-m/agentshield |
| npm Package | npmjs.com/package/ecc-agentshield |
| Changelog | CHANGELOG.md |
| E Claude Code | github.com/affaan-m/e |
| Twitter | |

License

MIT

---

<di="center">

Built by · Part of E Claude Code

</div>

项目信息

开发语言：TypeScript

Star 数：1255

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕AI agent security scanner. Detect vulnerabilities in agent configurations, MCP servers, and tool permissions. Available as CLI, GitHub Action, ECC plugin, and GitHub App integration. 🛡️展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。