{"categories":[{"label":"Security","url":"https://skillfed.io/packages/category/security/3"}],"enrichment":{"capability":"CodeShield filters code generated by LLMs to detect and block insecure patterns before they reach production, using static analysis across multiple programming languages.","skillfed_tags":["llm-security","code-scanning","guardrail"],"use_cases":["Block insecure code suggestions in IDE-integrated AI coding assistants before developers see them.","Add warnings or reject unsafe code snippets returned by LLM chatbots used for coding help.","Scan code generated by automated LLM pipelines to enforce secure coding hygiene before merge.","Validate code produced by internal or third-party LLM services in CI/CD workflows.","Detect common insecure patterns (CWE violations) in bulk-generated code for compliance audits."],"what_it_does":"CodeShield is a runtime security filter designed to intercept insecure code generated by large language models before it enters production. It acts as a guardrail in workflows where LLMs assist with code generation\u2014whether as IDE plugins, chatbot code suggestions, or automated coding assistants\u2014flagging or blocking code that violates secure coding practices.\n\nThe package uses static analysis (via semgrep and the Insecure Code Detector library) to scan code across multiple programming languages for patterns matching over 50 CWEs. It employs a two-layer scanning strategy: a fast pattern check flags suspicious code, and only flagged content undergoes comprehensive analysis. According to the documentation, this design keeps 99% of benign requests under 70ms latency, with p90 latency at 450ms for thorough scans, making it suitable for production environments where both security and performance matter.","worth_installing":"Yes, if you deploy LLM-assisted code generation in production or development workflows. CodeShield fills a real gap: LLMs can generate insecure code even when fine-tuned for safety, and this package provides a lightweight, low-latency filter to catch it. Active maintenance, permissive license, and no known vulnerabilities support adoption. Install only if you actually integrate LLM code output into your pipeline; it's not a general-purpose static analyzer."},"id":"codeshield","links":{"html":"https://skillfed.io/packages/codeshield","md":"https://skillfed.io/packages/codeshield.md","pypi":"https://pypi.org/project/codeshield/"},"maintenance":{"status":"active"},"meta":{"latest_release":"2024-04-19","license_spdx":null,"license_treatment":"permissive","name":"codeshield","python_support":"supports_current","summary":"Shield against LLM generated insecure code"},"popularity":{"monthly_downloads":110025,"position":12486,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"1.0.1"}