Agent skill · security · affaan-m
security-scan
Scan your Claude Code configuration (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions. Use when auditing a .claude/ directory — CLAUDE.md, settings.json, MCP servers, hooks, or agent definitions.
Why this skill is useful
Adds specific commands and workflows for scanning and securing Claude Code configurations that the AI wouldn't reliably generate on its own.
What it needs
Requires ecc-agentshield installed locally. About 2k tokens when loaded. Last updated 2026-08-06. 238,342 stars on the source repository.
What this skill does
Security Scan Skill Audit your Claude Code configuration for security issues using AgentShield. When to Activate Setting up a new Claude Code project After modifying .claude/settings.json, CLAUDE.md, or MCP configs Before committing configuration changes When onboarding to a new repository with existing Claude Code configs Periodic security hygiene checks What It Scans File Checks ------ -------- CLAUDE.md Hardcoded secrets, auto-run instructions, prompt injection patterns settings.json Overly permissive allow lists, missing deny lists, dangerous bypass flags mcp.json Risky MCP servers, hardcoded env secrets, npx supply chain risks hooks/ Command injection via interpolation, data exfiltration, silent error suppression agents/.md Unrestricted tool access, prompt injection surface, missing model specs Prerequisites AgentShield must be installed. Check and install if needed: Usage Basic Scan Run against the current project's .claude/ directory: Output Formats Auto-Fix Apply safe fixes automatically (only fixes marked as auto-fixable): This will: Replace hardcoded secrets with environment variable references Tighten wildcard permissions to scoped alternatives Never modify manual-only suggestions Opus 4.6 Deep Analysis Run the adversarial three-agent pipeline for deeper analysis: This runs: 1. Attacker (Red Team) — finds attack vectors 2. Defender (Blue Team) — recommends hardening 3. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills affaan-m/security-scan--3beb1f