DEDUPED Hot AI repos, turned into use cases Get the Monday 5

How to write a detection signature for an internal risk with Forge Guardian

Use the guided intel wizard to add a signature for a package or pattern your team wants blocked.

Who it is forA security engineer who has seen a malicious package or pattern and wants the scanner to catch it without writing Go code.

The problemCommunity signatures may not cover a package or pattern that matters to your organization.

The outcomeA validated, tested signature that the scanner applies to future scans.

What you need first

  • A terminal (bash on Linux or macOS, or PowerShell on Windows), or Docker
  • A project directory with dependencies to scan
  • Git and make only if building from source

Steps

  1. Run fgctl intel new and follow the guided wizard, which the README says takes about 10 minutes
  2. Run fgctl intel validate . to check the signature schema
  3. Run fgctl intel test . against a real package to confirm the signature matches
  4. Run fgctl scan . on a project that includes the target to confirm the finding appears

Prompt for your agent

In the repo Mah3Sec/ForgeGuardian, create a detection signature for <package-or-pattern> using `fgctl intel new`, then run `fgctl intel validate .` and `fgctl intel test .`. Expected output is a passing validation and a test result for the target. Verify that validation passes before testing.

Caveat. The README says a signature needs no Go knowledge, but it does not describe the signature schema, so the wizard's prompts are the source of truth.

Use this in your AI agent

Ask your agent

Using the Deduped MCP, get the setup steps for Mah3Sec/ForgeGuardian and "Write a detection signature for an internal risk"

Add Deduped to Claude Code once

claude mcp add --transport http deduped https://dedupedai.com/mcp

Cursor, ChatGPT, others

Share: X LinkedIn Hacker News Email Copy link

Third-party repos we don't own. AI-written use cases can be wrong. Disclaimer