Menu
使用AgentShield扫描您的Claude代码配置（.claude/目录），以发现安全漏洞、配置错误和注入风险。检查CLAUDE.md、settings.json、MCP服务器、钩子和代理定义。
Create reproducible, cross-platform (macOS/Linux) development environments with Flox, a declarative Nix-based environment manager. Use when setting up project toolchains for any language, installing system-level dependencies (compilers, databases, native libs like openssl/BLAS), pinning exact package versions for a team, running local services (PostgreSQL, Redis, Kafka), onboarding developers with one command, or solving 'works on my machine' problems — including agent/vibe-coding setups that need project-scoped tools without sudo. Also use when the user mentions .flox/, manifest.toml, flox activate, or FloxHub.
Commercial-grade Python installer expert for Windows: Nuitka extreme compilation, dist slimming, DLL footprint analysis, and Inno Setup packaging to ship the smallest, fastest installers. Use only for advanced packaging/optimization (minimal size, fast startup), not basic script-to-exe conversion. 中文触发：Nuitka 极限优化、Python 商业打包、极限编译 Python、dist 瘦身、DLL 分析、最小安装包、最快启动、商业级打包风格
Use when a brand needs to discover or articulate its identity through structured multi-session interviews. Covers purpose, positioning, audience, personality, voice, narrative, and founder-brand tension across 8 modules using laddering, 5 Whys, and projective techniques. Produces a resumable session with disk-persisted state and a master brandbook (90_SYNTHESIS.md).
Use when a brand needs to discover or articulate its identity through structured multi-session interviews. Covers purpose, positioning, audience, personality, voice, narrative, and founder-brand tension across 8 modules using laddering, 5 Whys, and projective techniques. Produces a resumable session with disk-persisted state and a master brandbook (90_SYNTHESIS.md).
Use this skill to automate visual testing and UI interaction verification using browser automation after deploying features.
Visualize whether skills, rules, and agent definitions are actually followed — auto-generates scenarios at 3 prompt strictness levels, runs agents, classifies behavioral sequences, and reports compliance rates with full tool call timelines
| name | security-scan |
| description | 使用AgentShield扫描您的Claude代码配置（.claude/目录），以发现安全漏洞、配置错误和注入风险。检查CLAUDE.md、settings.json、MCP服务器、钩子和代理定义。 |
| origin | ECC |
使用 AgentShield 审计您的 Claude Code 配置中的安全问题。
.claude/settings.json、CLAUDE.md 或 MCP 配置后| 文件 | 检查项 |
|---|---|
CLAUDE.md | 硬编码的密钥、自动运行指令、提示词注入模式 |
settings.json | 过于宽松的允许列表、缺失的拒绝列表、危险的绕过标志 |
mcp.json | 有风险的 MCP 服务器、硬编码的环境变量密钥、npx 供应链风险 |
hooks/ | 通过 ${file} 插值导致的命令注入、数据泄露、静默错误抑制 |
agents/*.md | 无限制的工具访问、提示词注入攻击面、缺失的模型规格 |
必须安装 AgentShield。检查并在需要时安装：
# Check if installed
npx ecc-agentshield --version
# Install globally (recommended)
npm install -g ecc-agentshield
# Or run directly via npx (no install needed)
npx ecc-agentshield scan .
针对当前项目的 .claude/ 目录运行：
# Scan current project
npx ecc-agentshield scan
# Scan a specific path
npx ecc-agentshield scan --path /path/to/.claude
# Scan with minimum severity filter
npx ecc-agentshield scan --min-severity medium
# Terminal output (default) — colored report with grade
npx ecc-agentshield scan
# JSON — for CI/CD integration
npx ecc-agentshield scan --format json
# Markdown — for documentation
npx ecc-agentshield scan --format markdown
# HTML — self-contained dark-theme report
npx ecc-agentshield scan --format html > security-report.html
自动应用安全的修复（仅修复标记为可自动修复的问题）：
npx ecc-agentshield scan --fix
这将：
运行对抗性的三智能体流程以进行更深入的分析：
# Requires ANTHROPIC_API_KEY
export ANTHROPIC_API_KEY=your-key
npx ecc-agentshield scan --opus --stream
这将运行：
从头开始搭建一个新的安全 .claude/ 配置：
npx ecc-agentshield init
创建：
settings.jsonCLAUDE.mdmcp.json 占位符添加到您的 CI 流水线中：
- uses: affaan-m/agentshield@v1
with:
path: '.'
min-severity: 'medium'
fail-on-findings: true
| 等级 | 分数 | 含义 |
|---|---|---|
| A | 90-100 | 安全配置 |
| B | 75-89 | 轻微问题 |
| C | 60-74 | 需要注意 |
| D | 40-59 | 显著风险 |
| F | 0-39 | 严重漏洞 |
Bash(*)（无限制的 shell 访问）${file} 插值导致的命令注入2>/dev/null、|| true）npx -y 自动安装