security-scan

Name: security-scan
Author: affaan-m

6.0kinstalls35kforks

How to install security-scan?

affaan-m/everything-claude-code/security-scan

$npx -y skills add affaan-m/everything-claude-code --skill security-scan

Installs into the current project.

Summary

Scan your Claude Code configuration (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions.

Files · 1

View on GitHub

SKILL.md

1	# Security Scan Skill
2
3	Audit your Claude Code configuration for security issues using [AgentShield](https://github.com/affaan-m/agentshield).
4
5	## When to Activate
6
7	- Setting up a new Claude Code project
8	- After modifying `.claude/settings.json`, `CLAUDE.md`, or MCP configs
9	- Before committing configuration changes
10	- When onboarding to a new repository with existing Claude Code configs
11	- Periodic security hygiene checks
12
13	## What It Scans
14
15	\| File \| Checks \|
16	\|------\|--------\|
17	\| `CLAUDE.md` \| Hardcoded secrets, auto-run instructions, prompt injection patterns \|
18	\| `settings.json` \| Overly permissive allow lists, missing deny lists, dangerous bypass flags \|
19	\| `mcp.json` \| Risky MCP servers, hardcoded env secrets, npx supply chain risks \|
20	\| `hooks/` \| Command injection via interpolation, data exfiltration, silent error suppression \|
21	\| `agents/*.md` \| Unrestricted tool access, prompt injection surface, missing model specs \|
22
23	## Prerequisites
24
25	AgentShield must be installed. Check and install if needed:
26
27	```bash
28	# Check if installed
29	npx ecc-agentshield --version
30
31	# Install globally (recommended)
32	npm install -g ecc-agentshield
33
34	# Or run directly via npx (no install needed)
35	npx ecc-agentshield scan .
36	```
37
38	## Usage
39
40	### Basic Scan
41
42	Run against the current project's `.claude/` directory:
43
44	```bash
45	# Scan current project
46	npx ecc-agentshield scan
47
48	# Scan a specific path
49	npx ecc-agentshield scan --path /path/to/.claude
50
51	# Scan with minimum severity filter
52	npx ecc-agentshield scan --min-severity medium
53	```
54
55	### Output Formats
56
57	```bash
58	# Terminal output (default) — colored report with grade
59	npx ecc-agentshield scan
60
61	# JSON — for CI/CD integration
62	npx ecc-agentshield scan --format json
63
64	# Markdown — for documentation
65	npx ecc-agentshield scan --format markdown
66
67	# HTML — self-contained dark-theme report
68	npx ecc-agentshield scan --format html > security-report.html
69	```
70
71	### Auto-Fix
72
73	Apply safe fixes automatically (only fixes marked as auto-fixable):
74
75	```bash
76	npx ecc-agentshield scan --fix
77	```
78
79	This will:
80	- Replace hardcoded secrets with environment variable references
81	- Tighten wildcard permissions to scoped alternatives
82	- Never modify manual-only suggestions
83
84	### Opus 4.6 Deep Analysis
85
86	Run the adversarial three-agent pipeline for deeper analysis:
87
88	```bash
89	# Requires ANTHROPIC_API_KEY
90	export ANTHROPIC_API_KEY=your-key
91	npx ecc-agentshield scan --opus --stream
92	```
93
94	This runs:
95	1. Attacker (Red Team) — finds attack vectors
96	2. Defender (Blue Team) — recommends hardening
97	3. Auditor (Final Verdict) — synthesizes both perspectives
98
99	### Initialize Secure Config
100
101	Scaffold a new secure `.claude/` configuration from scratch:
102
103	```bash
104	npx ecc-agentshield init
105	```
106
107	Creates:
108	- `settings.json` with scoped permissions and deny list
109	- `CLAUDE.md` with security best practices
110	- `mcp.json` placeholder
111
112	### GitHub Action
113
114	Add to your CI pipeline:
115
116	```yaml
117	- uses: affaan-m/agentshield@v1
118	with:
119	path: '.'
120	min-severity: 'medium'
121	fail-on-findings: true
122	```
123
124	## Severity Levels
125
126	\| Grade \| Score \| Meaning \|
127	\|-------\|-------\|---------\|
128	\| A \| 90-100 \| Secure configuration \|
129	\| B \| 75-89 \| Minor issues \|
130	\| C \| 60-74 \| Needs attention \|
131	\| D \| 40-59 \| Significant risks \|
132	\| F \| 0-39 \| Critical vulnerabilities \|
133
134	## Interpreting Results
135
136	### Critical Findings (fix immediately)
137	- Hardcoded API keys or tokens in config files
138	- `Bash(*)` in the allow list (unrestricted shell access)
139	- Command injection in hooks via `${file}` interpolation
140	- Shell-running MCP servers
141
142	### High Findings (fix before production)
143	- Auto-run instructions in CLAUDE.md (prompt injection vector)
144	- Missing deny lists in permissions
145	- Agents with unnecessary Bash access
146
147	### Medium Findings (recommended)
148	- Silent error suppression in hooks (`2>/dev/null`, `\|\| true`)
149	- Missing PreToolUse security hooks
150	- `npx -y` auto-install in MCP server configs
151
152	### Info Findings (awareness)
153	- Missing descriptions on MCP servers
154	- Prohibitive instructions correctly flagged as good practice
155
156	## Links
157
158	- GitHub: [github.com/affaan-m/agentshield](https://github.com/affaan-m/agentshield)
159	- npm: [npmjs.com/package/ecc-agentshield](https://www.npmjs.com/package/ecc-agentshield)

People who liked this also viewed

6 picks

Type

security-scan

6.0kinstalls35kforks

View on GitHub

How to install security-scan?

affaan-m/everything-claude-code/security-scan

$npx -y skills add affaan-m/everything-claude-code --skill security-scan

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Security Scan Skill
2
3	Audit your Claude Code configuration for security issues using [AgentShield](https://github.com/affaan-m/agentshield).
4
5	## When to Activate
6
7	- Setting up a new Claude Code project
8	- After modifying `.claude/settings.json`, `CLAUDE.md`, or MCP configs
9	- Before committing configuration changes
10	- When onboarding to a new repository with existing Claude Code configs
11	- Periodic security hygiene checks
12
13	## What It Scans
14
15	\| File \| Checks \|
16	\|------\|--------\|
17	\| `CLAUDE.md` \| Hardcoded secrets, auto-run instructions, prompt injection patterns \|
18	\| `settings.json` \| Overly permissive allow lists, missing deny lists, dangerous bypass flags \|
19	\| `mcp.json` \| Risky MCP servers, hardcoded env secrets, npx supply chain risks \|
20	\| `hooks/` \| Command injection via interpolation, data exfiltration, silent error suppression \|
21	\| `agents/*.md` \| Unrestricted tool access, prompt injection surface, missing model specs \|
22
23	## Prerequisites
24
25	AgentShield must be installed. Check and install if needed:
26
27	```bash
28	# Check if installed
29	npx ecc-agentshield --version
30
31	# Install globally (recommended)
32	npm install -g ecc-agentshield
33
34	# Or run directly via npx (no install needed)
35	npx ecc-agentshield scan .
36	```
37
38	## Usage
39
40	### Basic Scan
41
42	Run against the current project's `.claude/` directory:
43
44	```bash
45	# Scan current project
46	npx ecc-agentshield scan
47
48	# Scan a specific path
49	npx ecc-agentshield scan --path /path/to/.claude
50
51	# Scan with minimum severity filter
52	npx ecc-agentshield scan --min-severity medium
53	```
54
55	### Output Formats
56
57	```bash
58	# Terminal output (default) — colored report with grade
59	npx ecc-agentshield scan
60
61	# JSON — for CI/CD integration
62	npx ecc-agentshield scan --format json
63
64	# Markdown — for documentation
65	npx ecc-agentshield scan --format markdown
66
67	# HTML — self-contained dark-theme report
68	npx ecc-agentshield scan --format html > security-report.html
69	```
70
71	### Auto-Fix
72
73	Apply safe fixes automatically (only fixes marked as auto-fixable):
74
75	```bash
76	npx ecc-agentshield scan --fix
77	```
78
79	This will:
80	- Replace hardcoded secrets with environment variable references
81	- Tighten wildcard permissions to scoped alternatives
82	- Never modify manual-only suggestions
83
84	### Opus 4.6 Deep Analysis
85
86	Run the adversarial three-agent pipeline for deeper analysis:
87
88	```bash
89	# Requires ANTHROPIC_API_KEY
90	export ANTHROPIC_API_KEY=your-key
91	npx ecc-agentshield scan --opus --stream
92	```
93
94	This runs:
95	1. Attacker (Red Team) — finds attack vectors
96	2. Defender (Blue Team) — recommends hardening
97	3. Auditor (Final Verdict) — synthesizes both perspectives
98
99	### Initialize Secure Config
100
101	Scaffold a new secure `.claude/` configuration from scratch:
102
103	```bash
104	npx ecc-agentshield init
105	```
106
107	Creates:
108	- `settings.json` with scoped permissions and deny list
109	- `CLAUDE.md` with security best practices
110	- `mcp.json` placeholder
111
112	### GitHub Action
113
114	Add to your CI pipeline:
115
116	```yaml
117	- uses: affaan-m/agentshield@v1
118	with:
119	path: '.'
120	min-severity: 'medium'
121	fail-on-findings: true
122	```
123
124	## Severity Levels
125
126	\| Grade \| Score \| Meaning \|
127	\|-------\|-------\|---------\|
128	\| A \| 90-100 \| Secure configuration \|
129	\| B \| 75-89 \| Minor issues \|
130	\| C \| 60-74 \| Needs attention \|
131	\| D \| 40-59 \| Significant risks \|
132	\| F \| 0-39 \| Critical vulnerabilities \|
133
134	## Interpreting Results
135
136	### Critical Findings (fix immediately)
137	- Hardcoded API keys or tokens in config files
138	- `Bash(*)` in the allow list (unrestricted shell access)
139	- Command injection in hooks via `${file}` interpolation
140	- Shell-running MCP servers
141
142	### High Findings (fix before production)
143	- Auto-run instructions in CLAUDE.md (prompt injection vector)
144	- Missing deny lists in permissions
145	- Agents with unnecessary Bash access
146
147	### Medium Findings (recommended)
148	- Silent error suppression in hooks (`2>/dev/null`, `\|\| true`)
149	- Missing PreToolUse security hooks
150	- `npx -y` auto-install in MCP server configs
151
152	### Info Findings (awareness)
153	- Missing descriptions on MCP servers
154	- Prohibitive instructions correctly flagged as good practice
155
156	## Links
157
158	- GitHub: [github.com/affaan-m/agentshield](https://github.com/affaan-m/agentshield)
159	- npm: [npmjs.com/package/ecc-agentshield](https://www.npmjs.com/package/ecc-agentshield)

People who liked this also viewed

6 picks

Type