skills.rest
pjherron
pjherronCOMMUNITY
Explore all skills by this author →
GitHub

security-scan

Scan Claude Code configuration files for security vulnerabilities and misconfigurations using AgentShield.

Updated Jul 16, 2026
Search Tags:#claude code#security scan#prompt injection#secrets detection#configuration audit#agentshield#ci security
One-click install
npx skills add https://github.com/pjherron/hypoc --skill security-scan-pjherron
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-scan
Source: https://github.com/pjherron/hypoc/tree/main/hypoc/skills/security-scan
Command: npx skills add https://github.com/pjherron/hypoc --skill security-scan-pjherron

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires ecc-agentshield.

What problem does it solve? Claude Code configurations (CLAUDE.md, settings.json, MCP servers, hooks, agent definitions) can contain hardcoded secrets, overly permissive permissions, prompt injection vectors, and command injection risks that are easy to miss during manual review. ## Core Features & Use Cases - Configuration Auditing: Scans CLAUDE.md, settings.json, mcp.json, hooks, and agent definitions for secrets, dangerous permissions, and injection patterns, producing a graded report (A-F). - Auto-Fix and CI Integration: Applies safe automatic fixes for issues like hardcoded secrets and wildcard permissions, and outputs JSON, Markdown, or HTML reports suitable for CI/CD pipelines via a GitHub Action. - Deep Adversarial Analysis: Runs an optional three-agent red team/blue team/auditor pipeline for deeper threat analysis. - Use Case: Before committing changes to .claude/settings.json, run a scan to catch a Bash(*) wildcard permission or a hardcoded API key before it reaches production. ## Quick Start Scan my current project's Claude Code configuration for security issues and show me any critical or high severity findings.

Frequently Asked Questions about security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan my Claude Code configuration for security issues?▼

Run npx ecc-agentshield scan in your project directory to audit the .claude/ folder. It checks CLAUDE.md, settings.json, MCP configs, hooks, and agent definitions, then reports findings with severity grades from A to F.

How to automatically fix security findings in Claude Code settings?▼

Run npx ecc-agentshield scan --fix to apply safe automatic fixes. It replaces hardcoded secrets with environment variable references and tightens wildcard permissions, but never modifies findings marked as manual-only.

Can I run AgentShield security scans in a CI/CD pipeline?▼

Yes, use the affaan-m/agentshield GitHub Action with a path, min-severity threshold, and fail-on-findings option. You can also run the CLI with --format json to integrate scan results into any CI system.

What security risks does AgentShield detect in MCP server configs?▼

It detects risky MCP servers, hardcoded environment secrets, npx supply chain risks from npx -y auto-installs, and shell-running MCP servers. These are reported as critical or high severity findings depending on exposure.

Does the security scan require an API key to run?▼

The standard scan runs locally without any API key. Only the optional --opus deep analysis mode, which runs an adversarial three-agent red team, blue team, and auditor pipeline, requires an ANTHROPIC_API_KEY.

Related Skills

Explore More Software Engineering Skills→
sakamoto-family-smilesakamoto-family-smile

security-scan

Audit Claude Code configuration files for security vulnerabilities and misconfigurations.

Community
Advanced
0xHoneyJar0xHoneyJar

audit-env

Scan environment files, client code, and git history for secret leakage.

Official
Advanced
cwijayasundaracwijayasundara
3

keeping-refactors-pure

Classify commits to separate refactor and behavioral changes in codebases.

Community
Advanced
OWASPOWASP
141

secrets-scan

Detect hardcoded secrets in source code and configuration files.

Official
Intermediate