security-scan

Name: security-scan
Availability: InStock
Author: fabio29t

Scan Claude Code configurations for vulnerabilities and misconfigurations using AgentShield.

Updated Mar 4, 2026

Search Tags:#security #vulnerability #claude code #configuration #scan #agentshield

Ready to run

npx skills add https://github.com/Fabio29T/Everything-Claude --skill security-scan-fabio29t

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-scan
Source: https://github.com/Fabio29T/Everything-Claude/tree/main/docs/ja-JP/skills/security-scan
Command: npx skills add https://github.com/Fabio29T/Everything-Claude --skill security-scan-fabio29t

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires ecc-agentshield, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill addresses the critical need to identify and mitigate security vulnerabilities, misconfigurations, and potential injection risks within Claude Code project settings, ensuring a more secure AI development environment.

Core Features & Use Cases

Vulnerability Scanning: Audits CLAUDE.md, settings.json, MCP configurations, hooks, and agent definitions for security flaws.
Risk Assessment: Assigns severity levels (A-F) to identified issues, from secure configurations to critical vulnerabilities.
Automated Remediation: Offers options to automatically fix certain security issues, such as replacing hardcoded secrets with environment variable references.
Use Case: Before committing changes to a production Claude Code project, run this skill to automatically detect and fix any newly introduced security risks, preventing potential data breaches or unauthorized access.

Quick Start

Run the security scan for the current project's .claude directory.

Frequently Asked Questions about security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan Claude Code configurations for security vulnerabilities?▼

The scan checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions for hardcoded secrets, injection risks, and overly permissive settings. It assigns severity levels from A (secure) to F (critical) and supports JSON or Markdown output formats.

Can I automatically fix hardcoded secrets found in Claude Code settings?▼

Yes, the scan offers automated remediation options to fix certain security issues, such as replacing hardcoded secrets with environment variable references. This helps secure your AI development environment without manual code changes.

Does the security scan require AgentShield to audit MCP servers and hooks?▼

Yes, AgentShield is a required dependency for this security scan. It provides the core vulnerability detection engine needed to audit MCP configurations, hooks, and agent definitions within your Claude Code project settings.

What is the best way to audit CLAUDE.md files for injection risks before production?▼

The best way to audit CLAUDE.md files for injection risks is to run a security scan with deep analysis enabled using Opus models before committing changes. This detects potential data breaches or unauthorized access risks in your production Claude Code project.

What security misconfigurations are detected in Claude Code agent definitions?▼

The scan detects hardcoded secrets, injection risks, and overly permissive settings within agent definitions. It evaluates these misconfigurations and assigns severity levels ranging from secure A grades to critical F grade vulnerabilities.