Verified:GitHub

security-scan

Scan Claude Code configurations for security vulnerabilities using AgentShield.

Updated Apr 6, 2026

Search Tags:#vulnerability assessment #Claude Code #security scanning #AgentShield #configuration auditing

One-click install

npx skills add https://github.com/thangvawn/agent_financial --skill security-scan-thangvawn

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: security-scan
Source: https://github.com/thangvawn/agent_financial/tree/main/.cursor/skills/security-scan
Command: npx skills add https://github.com/thangvawn/agent_financial --skill security-scan-thangvawn

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires ecc-agentshield, and includes scripts (resource) components.

What problem does it solve?

This Skill identifies security vulnerabilities, misconfigurations, and injection risks in Claude Code configurations, ensuring a secure setup.

Core Features & Use Cases

Security Auditing: Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions for potential security issues.
Risk Assessment: Evaluates the severity of each finding, from critical vulnerabilities to informational awareness.
Automated Fixing: Applies safe fixes automatically to common issues, such as replacing hardcoded secrets with environment variables.
Deep Analysis: Offers an adversarial three-agent pipeline for deeper security analysis with ANTHROPIC_API_KEY.

Quick Start

Run the security-scan skill to scan your Claude Code configuration for vulnerabilities.

Frequently Asked Questions about security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan my Claude Code configuration for security vulnerabilities?▼

Scanning your Claude Code configuration involves running the security-scan skill to audit CLAUDE.md, settings.json, MCP servers, and hooks for misconfigurations and injection risks.

Does security scanning for Claude Code require an API key?▼

Basic security scanning requires the ecc-agentshield dependency, but enabling the deep adversarial three-agent analysis pipeline additionally requires an ANTHROPIC_API_KEY.

What is automated remediation for Claude Code settings?▼

Automated remediation for Claude Code settings applies safe fixes automatically, such as replacing hardcoded secrets with environment variables to resolve common vulnerabilities.

Can I audit MCP servers and hooks for injection risks?▼

You can audit MCP servers, hooks, and agent definitions for injection risks, as the security scanning process evaluates the severity of each finding from critical vulnerabilities to informational awareness.