security-scan

name	security-scan
description	Scan your Claude Code configuration (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions.
source_path	skills/security-scan/SKILL.md
origin	ECC

Security Scan Skill

Audit your Claude Code configuration for security issues using AgentShield.

When to Activate

• Setting up a new Claude Code project
• After modifying .claude/settings.json, CLAUDE.md, or MCP configs
• Before committing configuration changes
• When onboarding to a new repository with existing Claude Code configs
• Periodic security hygiene checks

What It Scans

File	Checks
CLAUDE.md	Hardcoded secrets, auto-run instructions, prompt injection patterns
settings.json	Overly permissive allow lists, missing deny lists, dangerous bypass flags
mcp.json	Risky MCP servers, hardcoded env secrets, npx supply chain risks
hooks/