skills.rest
firstsun-dev
firstsun-devOFFICIAL
Explore all skills by this author →
WebsiteGitHub

security-scan

Scan Claude Code configuration files for security vulnerabilities and misconfigurations using AgentShield.

3|1|Updated Apr 29, 2026
Search Tags:#ci/cd#claude code#mcp#security scan#vulnerability detection#configuration audit#agentshield
One-click install
npx skills add https://github.com/firstsun-dev/skills --skill security-scan-firstsun-dev
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-scan
Source: https://github.com/firstsun-dev/skills/tree/main/plugins/software-delivery/skills/security-scan
Command: npx skills add https://github.com/firstsun-dev/skills --skill security-scan-firstsun-dev

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires ecc-agentshield.

What problem does it solve? Claude Code configurations (.claude/ directory) can contain hardcoded secrets, overly permissive permissions, prompt injection vectors, and risky MCP server setups that expose projects to security threats. This Skill audits those configuration files automatically so vulnerabilities are caught before they reach production. ## Core Features & Use Cases - Configuration Auditing: Scans CLAUDE.md, settings.json, mcp.json, hooks, and agent definitions for hardcoded secrets, wildcard permissions, command injection, and supply chain risks. - Graded Reports & Auto-Fix: Produces severity-graded findings (A-F scores) in terminal, JSON, Markdown, or HTML formats, and can automatically apply safe fixes like replacing hardcoded secrets with environment variable references. - CI/CD Integration: Runs as a GitHub Action to fail builds on security findings, plus an optional adversarial three-agent deep analysis mode for red team/blue team assessment. - Use Case: Before committing changes to .claude/settings.json, run a scan to verify no Bash(*) wildcards or hardcoded API keys slipped in, then export a JSON report for your CI pipeline. ## Quick Start Ask the agent to scan the current project's .claude directory for security vulnerabilities and report any critical or high severity findings.

Frequently Asked Questions about security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan my Claude Code configuration for security issues?▼

Run npx ecc-agentshield scan in your project directory to audit the .claude/ folder. It checks CLAUDE.md, settings.json, mcp.json, hooks, and agent definitions, then outputs a graded report with severity levels.

What security risks does AgentShield detect in Claude Code configs?▼

AgentShield detects hardcoded API keys, unrestricted Bash(*) permissions, command injection in hooks via interpolation, risky MCP servers, prompt injection patterns in CLAUDE.md, and missing deny lists in permission settings.

Can I run security scans in a CI/CD pipeline?▼

Yes, use the affaan-m/agentshield GitHub Action with a minimum severity threshold and fail-on-findings enabled. You can also run npx ecc-agentshield scan --format json to integrate results into any CI system.

Does the security scan automatically fix vulnerabilities?▼

Yes, running with the --fix flag applies safe auto-fixable changes, such as replacing hardcoded secrets with environment variable references and tightening wildcard permissions. Manual-only suggestions are never modified.

Do I need to install AgentShield before scanning?▼

No installation is required since npx ecc-agentshield scan runs the tool directly. For repeated use, you can install it globally with npm install -g ecc-agentshield.

Related Skills

Explore More Software Engineering Skills→
Sake-TeamSake-Team

security-scan

Scan Claude Code configurations for vulnerabilities and misconfigurations.

Official
Advanced
0xHoneyJar0xHoneyJar

audit-env

Scan environment files, client code, and git history for secret leakage.

Official
Advanced
BenWork17BenWork17

vulnerability-scanner

Identify and prioritize software vulnerabilities across code repositories and CI/CD pipelines.

Community
Advanced
voidrotvoidrot

security-scan

Scan Claude Code and agent configurations for security vulnerabilities.

Community
Advanced