Source profileQuality 85/100Review permissions

affaan-m/ECC/skills/security-scan/SKILL.md

security-scan

Scan your Claude Code configuration (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions.

Source repository stars
234,327
Declared platforms
1
Static risk flags
1
Last source update
2026-07-27
Source checked
2026-07-28
DecisionCompatibilityInstallWorkflowPermissionsEvidenceSource

Decision brief

What it does—and where it fits

Audit your Claude Code configuration for security issues using AgentShield.

Best for

    Not for

    • Tasks that require unconfirmed production actions or broad system permissions.
    • Environments where the pinned source and install steps cannot be inspected.

    Compatibility matrix

    Platform support, with evidence labels

    PlatformStatusEvidenceWhat to check
    CodexNot declaredNo explicit evidencePortability before use
    Claude CodeDeclaredSource recordInstall path and trigger
    CursorNot declaredNo explicit evidencePortability before use
    Gemini CLINot declaredNo explicit evidencePortability before use
    Open the compatibility checker

    Installation

    Inspect first. Install second.

    The source command is displayed only when detected. A safe inspection prompt is always available so your agent can explain every action before execution.

    Source-detected install commandSource
    npx skills add https://github.com/affaan-m/ECC --skill "skills/security-scan"
    Safe inspection promptEditorial

    Inspect the Agent Skill "security-scan" from https://github.com/affaan-m/ECC/blob/4e973d3eaf92d97f8d2e2d8abb39d8bdc8711b38/skills/security-scan/SKILL.md at commit 4e973d3eaf92d97f8d2e2d8abb39d8bdc8711b38. List every install step, command, network request, credential, file read/write, external action, and rollback step. Explain whether it fits my task. Do not install or execute anything until I approve.

    Workflow

    What the source asks the agent to do

    1. 01

      Usage

      Run against the current project's .claude/ directory:

      Run against the current project's .claude/ directory:
    2. 02

      When to Activate

      Setting up a new Claude Code project

      Setting up a new Claude Code projectAfter modifying .claude/settings.json, CLAUDE.md, or MCP configsBefore committing configuration changes
    3. 03

      What It Scans

      Review the “What It Scans” section in the pinned source before continuing.

      Review and apply the “What It Scans” source section.
    4. 04

      Prerequisites

      AgentShield must be installed. Check and install if needed:

      AgentShield must be installed. Check and install if needed:
    5. 05

      Check if installed

      Review the “Check if installed” section in the pinned source before continuing.

      Review and apply the “Check if installed” source section.

    Permission review

    Static risk signals and limitations

    Runs scripts

    medium · line 29

    The documentation asks the agent to run terminal commands or scripts.

    npx ecc-agentshield --version

    Runs scripts

    medium · line 32

    The documentation asks the agent to run terminal commands or scripts.

    npm install -g ecc-agentshield

    Evidence record

    Why each signal appears

    EvidenceSourceComputedTestedEditorial
    SignalValueEvidence typeMeaning
    Quality score85/100ComputedDocumentation, specificity, maintenance, and trust rules
    Repository stars234,327SourceRepository attention, not individual Skill quality
    Compatibility1 platformsSourceDeclared in the catalog source record
    Usage guideautomated source guideEditorialGenerated or reviewed according to the visible evidence level

    Pinned source

    Provenance and original SKILL.md

    Repository
    affaan-m/ECC
    Skill path
    skills/security-scan/SKILL.md
    Commit
    4e973d3eaf92d97f8d2e2d8abb39d8bdc8711b38
    License
    MIT
    Collected
    2026-07-28
    Default branch
    main
    View the original SKILL.md

    Security Scan Skill

    Audit your Claude Code configuration for security issues using AgentShield.

    When to Activate

    • Setting up a new Claude Code project
    • After modifying .claude/settings.json, CLAUDE.md, or MCP configs
    • Before committing configuration changes
    • When onboarding to a new repository with existing Claude Code configs
    • Periodic security hygiene checks

    What It Scans

    FileChecks
    CLAUDE.mdHardcoded secrets, auto-run instructions, prompt injection patterns
    settings.jsonOverly permissive allow lists, missing deny lists, dangerous bypass flags
    mcp.jsonRisky MCP servers, hardcoded env secrets, npx supply chain risks
    hooks/Command injection via interpolation, data exfiltration, silent error suppression
    agents/*.mdUnrestricted tool access, prompt injection surface, missing model specs

    Prerequisites

    AgentShield must be installed. Check and install if needed:

    # Check if installed
npx ecc-agentshield --version

# Install globally (recommended)
npm install -g ecc-agentshield

# Or run directly via npx (no install needed)
npx ecc-agentshield scan .

    Usage

    Basic Scan

    Run against the current project's .claude/ directory:

    # Scan current project
npx ecc-agentshield scan

# Scan a specific path
npx ecc-agentshield scan --path /path/to/.claude

# Scan with minimum severity filter
npx ecc-agentshield scan --min-severity medium

    Output Formats

    # Terminal output (default) — colored report with grade
npx ecc-agentshield scan

# JSON — for CI/CD integration
npx ecc-agentshield scan --format json

# Markdown — for documentation
npx ecc-agentshield scan --format markdown

# HTML — self-contained dark-theme report
npx ecc-agentshield scan --format html > security-report.html

    Auto-Fix

    Apply safe fixes automatically (only fixes marked as auto-fixable):

    npx ecc-agentshield scan --fix

    This will:

    • Replace hardcoded secrets with environment variable references
    • Tighten wildcard permissions to scoped alternatives
    • Never modify manual-only suggestions

    Opus 4.6 Deep Analysis

    Run the adversarial three-agent pipeline for deeper analysis:

    # Requires ANTHROPIC_API_KEY
export ANTHROPIC_API_KEY=your-key
npx ecc-agentshield scan --opus --stream

    This runs:

    1. Attacker (Red Team) — finds attack vectors
    2. Defender (Blue Team) — recommends hardening
    3. Auditor (Final Verdict) — synthesizes both perspectives

    Initialize Secure Config

    Scaffold a new secure .claude/ configuration from scratch:

    npx ecc-agentshield init

    Creates:

    • settings.json with scoped permissions and deny list
    • CLAUDE.md with security best practices
    • mcp.json placeholder

    GitHub Action

    Add to your CI pipeline:

    - uses: affaan-m/agentshield@v1
  with:
    path: '.'
    min-severity: 'medium'
    fail-on-findings: true

    Severity Levels

    GradeScoreMeaning
    A90-100Secure configuration
    B75-89Minor issues
    C60-74Needs attention
    D40-59Significant risks
    F0-39Critical vulnerabilities

    Interpreting Results

    Critical Findings (fix immediately)

    • Hardcoded API keys or tokens in config files
    • Bash(*) in the allow list (unrestricted shell access)
    • Command injection in hooks via ${file} interpolation
    • Shell-running MCP servers

    High Findings (fix before production)

    • Auto-run instructions in CLAUDE.md (prompt injection vector)
    • Missing deny lists in permissions
    • Agents with unnecessary Bash access

    Medium Findings (recommended)

    • Silent error suppression in hooks (2>/dev/null, || true)
    • Missing PreToolUse security hooks
    • npx -y auto-install in MCP server configs

    Info Findings (awareness)

    • Missing descriptions on MCP servers
    • Prohibitive instructions correctly flagged as good practice

    Links

    Alternatives

    Compare before choosing

    Computed 71234,327

    affaan-m/ECC

    security-scan

    Use it for engineering tasks; the detail page covers purpose, installation, and practical steps.

    2026-07-271 platforms
    Computed 9315

    jackchuka/skills

    claude-skill-spec-audit

    Audit skill SKILL.md files for compliance with the agentskills.io specification and house conventions. Checks frontmatter fields (name, description, compatibility, metadata, argument-hint), metadata sub-fields (author, scope, layer, confirms), and layer/suffix consistency. Use when adding new skills, reviewing skill quality, or ensuring all skills follow the spec. Triggers: "audit skills", "check skill spec", "skill compliance", "are my skills up to spec", "/claude-skill-spec-audit".

    2026-07-281 platforms
    Computed 92234,327

    affaan-m/ECC

    autonomous-loops

    Patterns and architectures for autonomous Claude Code loops — from simple sequential pipelines to RFC-driven multi-agent DAG systems.

    2026-07-271 platforms
    Computed 90234,327

    affaan-m/ECC

    quality-nonconformance

    Codified expertise for quality control, non-conformance investigation, root cause analysis, corrective action, and supplier quality management in regulated manufacturing. Informed by quality engineers with 15+ years experience across FDA, IATF 16949, and AS9100 environments. Includes NCR lifecycle management, CAPA systems, SPC interpretation, and audit methodology. Use when investigating non-conformances, performing root cause analysis, managing CAPAs, interpreting SPC data, or handling supplier

    2026-07-271 platforms