skills.rest
ibytechaos
ibytechaosCOMMUNITY
Explore all skills by this author →
GitHub

security-scan

Scans Claude Code configuration files for security vulnerabilities and injection risks using AgentShield.

1|Updated Oct 11, 2025
Search Tags:#claude code#mcp#security scan#prompt injection#secrets detection#configuration audit#agentshield
One-click install
npx skills add https://github.com/ibytechaos/claude --skill security-scan-ibytechaos
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-scan
Source: https://github.com/ibytechaos/claude/tree/main/plugins/everything-claude-code/skills/security-scan
Command: npx skills add https://github.com/ibytechaos/claude --skill security-scan-ibytechaos

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires ecc-agentshield.

What problem does it solve? Claude Code configurations like CLAUDE.md, settings.json, and MCP server definitions can contain hardcoded secrets, overly permissive permissions, and prompt injection vectors that are easy to miss during manual review. This Skill audits your .claude/ directory and reports graded findings before they become production risks. ## Core Features & Use Cases - Configuration Auditing: Scans CLAUDE.md, settings.json, mcp.json, hooks, and agent definitions for secrets, dangerous permissions, and injection patterns. - Auto-Fix and CI Integration: Applies safe automatic fixes and outputs JSON, Markdown, or HTML reports suitable for GitHub Actions pipelines. - Deep Adversarial Analysis: Runs an optional three-agent red team, blue team, and auditor pipeline for deeper threat assessment. - Use Case: Before committing a new .claude/ setup to a shared repository, run a scan to catch a hardcoded API key in mcp.json and an unrestricted Bash(*) allow rule, then auto-fix both. ## Quick Start Ask the assistant to run a security scan on the current project's .claude directory and report any critical or high severity findings.

Frequently Asked Questions about security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan my Claude Code configuration for security issues?▼

Run npx ecc-agentshield scan in your project root to audit the .claude/ directory. It checks CLAUDE.md, settings.json, mcp.json, hooks, and agent definitions, then outputs a graded report with severity levels.

What security problems does AgentShield detect in Claude Code configs?▼

AgentShield detects hardcoded API keys and tokens, unrestricted Bash(*) allow lists, command injection in hooks via interpolation, risky MCP servers, auto-run instructions in CLAUDE.md, and missing deny lists in permission settings.

Can I run a Claude Code security scan in CI/CD pipelines?▼

Yes, use the affaan-m/agentshield GitHub Action with a path, minimum severity, and fail-on-findings option. You can also run npx ecc-agentshield scan --format json for machine-readable output in any CI system.

Does the security scan automatically fix vulnerabilities it finds?▼

Yes, running npx ecc-agentshield scan --fix applies safe automatic fixes such as replacing hardcoded secrets with environment variable references and tightening wildcard permissions. Suggestions marked manual-only are never modified.

Do I need to install anything before running the security scan?▼

No installation is required since npx ecc-agentshield scan runs the tool directly. For repeated use, install it globally with npm install -g ecc-agentshield. The optional deep analysis mode requires an ANTHROPIC_API_KEY.

Related Skills

Explore More Software Engineering Skills→
emiled16emiled16

security-scan

Audit Claude Code configuration files for security vulnerabilities and misconfigurations.

Community
Intermediate
itallstartedwithaideaitallstartedwithaidea
31

secret-protection

Scan .env files, code, and diffs for exposed secrets and redact runtime outputs.

Community
Advanced
dthuy62dthuy62

ck:code-review

Review code changes for defects, security flaws, and requirement mismatches.

Community
Advanced
OWASPOWASP
141

secrets-scan

Detect hardcoded secrets in source code and configuration files.

Official
Intermediate