Agent skill · security · affaan-m
security-scan
Scan your Claude Code configuration (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions. Use when auditing a .claude/ directory — CLAUDE.md, settings.json, MCP servers, hooks, or agent definitions.
Why this skill is useful
Adds executable scripts for security scanning and auto-fixing vulnerabilities in Claude Code configurations that aren't in public documentation.
What it needs
Requires ecc-agentshield installed locally. About 2k tokens when loaded. Last updated 2026-08-06. 238,342 stars on the source repository.
What this skill does
Security Scan Skill Audit your Claude Code configuration for security issues using AgentShield. When to Activate Setting up a new Claude Code project After modifying .claude/settings.json, CLAUDE.md, or MCP configs Before committing configuration changes When onboarding to a new repository with existing Claude Code configs Periodic security hygiene checks What It Scans File Checks ------ -------- CLAUDE.md Hardcoded secrets, auto-run instructions, prompt injection patterns settings.json Overly permissive allow lists, missing deny lists, dangerous bypass flags mcp.json Risky MCP servers, hardcoded env secrets, npx supply chain risks hooks/ Command injection via interpolation, data exfiltration, silent error suppression agents/.md Unrestricted tool access, prompt injection surface, missing model specs Prerequisites AgentShield must be installed. Check and install if needed: Usage Basic Scan Run against the current project's .claude/ directory: Output Formats Auto-Fix Apply safe fixes automatically (only fixes marked as auto-fixable): This will: Replace hardcoded secrets with environment variable references Tighten wildcard permissions to scoped alternatives Never modify manual-only suggestions Opus 4.6 Deep Analysis Run the adversarial three-agent pipeline for deeper analysis: This runs: 1. Attacker (Red Team) — finds attack vectors 2. Defender (Blue Team) — recommends hardening 3. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills affaan-m/security-scan--794ca6