security-scan

Audit Claude Code configurations for security vulnerabilities using AgentShield.

Updated Apr 4, 2026

Search Tags:#security #mcp #config #vulnerabilities #claude-code #scan #agentshield

Ready to run

npx skills add https://github.com/mitul-bhatia/Vibes --skill security-scan-mitul-bhatia

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-scan
Source: https://github.com/mitul-bhatia/Vibes/tree/main/.github/skills/security-scan
Command: npx skills add https://github.com/mitul-bhatia/Vibes --skill security-scan-mitul-bhatia

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Audit Claude Code configurations for security issues using AgentShield to detect vulnerabilities, misconfigurations, and prompt injection risks across CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions.

Core Features & Use Cases

Automated security checks to identify hardcoded secrets, risky permissions, and prompt-injection vectors in Claude Code configurations
Comprehensive scanning across CLAUDE.md, settings.json, mcp.json, hooks/, and agents/*.md
Use case: onboarding a new repository and performing periodic security hygiene checks before deployment

Quick Start

Install AgentShield and run a scan from the project root to audit your Claude Code configuration.

Frequently Asked Questions about security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan Claude Code configurations for security vulnerabilities?▼

To scan Claude Code configurations for security vulnerabilities, you use AgentShield to audit files like CLAUDE.md, settings.json, and mcp.json for hardcoded secrets, risky permissions, and prompt injection risks. Run the scan from your project root to generate a security report.

What is AgentShield used for in Claude Code projects?▼

AgentShield is used to detect security misconfigurations and prompt injection vectors in Claude Code projects. It checks configuration files, MCP servers, hooks, and agent definitions to ensure your setup follows security hygiene best practices before deployment.

Do I need to install AgentShield globally to audit MCP configs?▼

You do not need to install AgentShield globally to audit MCP configs; you can run it on demand using npx ecc-agentshield scan. Alternatively, installing it globally via npm install -g ecc-agentshield allows you to execute security scans directly from the project root.

What report formats are available for Claude Code security scans?▼

Available report formats for Claude Code security scans include terminal, json, markdown, and html outputs. These formats allow you to integrate security audit results into your CI/CD pipeline or review them directly in your project repository.

When should I perform a security hygiene check on my Claude Code setup?▼

You should perform a security hygiene check on your Claude Code setup during project onboarding, after modifying CLAUDE.md or settings.json, and periodically across repositories. This prevents vulnerabilities from persisting in your MCP servers, hooks, and agent definitions.