Menu
Scan Claude Code configuration for security vulnerabilities using AgentShield. Use before committing config changes or during periodic security checks.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
Use when you have a written implementation plan to execute in a separate session with review checkpoints
Extract learned patterns from session - invoked automatically by finishing-a-development-branch or manually anytime
Use when implementation is complete, all tests pass, and you need to decide how to integrate the work - guides completion of development work by presenting structured options for review, delivery, or cleanup
Use when executing implementation plans with independent tasks in the current session
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes
| name | security-scan |
| description | Scan Claude Code configuration for security vulnerabilities using AgentShield. Use before committing config changes or during periodic security checks. |
Audit your Claude Code configuration for security issues using AgentShield.
.claude/settings.json, CLAUDE.md, or MCP configs| File | Checks |
|---|---|
CLAUDE.md | Hardcoded secrets, auto-run instructions, prompt injection patterns |
settings.json | Overly permissive allow lists, missing deny lists, dangerous bypass flags |
mcp.json | Risky MCP servers, hardcoded env secrets, npx supply chain risks |
hooks/ | Command injection via interpolation, data exfiltration, silent error suppression |
agents/*.md | Unrestricted tool access, prompt injection surface, missing model specs |
# Check if installed
npx ecc-agentshield --version
# Install globally (recommended)
npm install -g ecc-agentshield
# Scan current project
npx ecc-agentshield scan
# Scan specific path
npx ecc-agentshield scan --path /path/to/.claude
# Filter by severity
npx ecc-agentshield scan --min-severity medium
# Terminal (default) — colored report with grade
npx ecc-agentshield scan
# JSON — for CI/CD
npx ecc-agentshield scan --format json
# Markdown — for docs
npx ecc-agentshield scan --format markdown
npx ecc-agentshield scan --fix
Replaces hardcoded secrets with env var references and tightens wildcard permissions. Never modifies manual-only suggestions.
| Grade | Score | Meaning |
|---|---|---|
| A | 90-100 | Secure configuration |
| B | 75-89 | Minor issues |
| C | 60-74 | Needs attention |
| D | 40-59 | Significant risks |
| F | 0-39 | Critical vulnerabilities |
Critical (fix immediately): Hardcoded API keys, Bash(*) in allow list, command injection in hooks, shell-running MCP servers.
High (fix before production): Auto-run instructions in CLAUDE.md, missing deny lists, agents with unnecessary Bash access.
Medium (recommended): Silent error suppression in hooks, missing PreToolUse security hooks, npx -y auto-install in MCP configs.
Run as part of finishing-a-development-branch workflow or manually anytime.