Back to browse

affaan-m/ECC

security-scan

Scan your Claude Code configuration (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions.

85CollectingClaude CodeRuns scripts
See how to use itView GitHub source
npx skills add https://github.com/affaan-m/ECC --skill "skills/security-scan"
Automated source guide

Source checked Jul 28, 2026·Refresh due Oct 26, 2026

Reorganized from the pinned upstream SKILL.md

Turn security-scan's source instructions into a guide you can follow

According to the pinned SKILL.md from affaan-m/ECC: Audit your Claude Code configuration for security issues using AgentShield.

npx skills add https://github.com/affaan-m/ECC --skill "skills/security-scan"
Check the pinned source

Best fit

  • Scan your Claude Code configuration (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions.

Bring this context

  • AgentShield must be installed. Check and install if needed:

Expected outputs

  • Hardcoded API keys or tokens in config files
  • Bash() in the allow list (unrestricted shell access)
  • Command injection in hooks via ${file} interpolation

Key source sections

Read security-scan through these 5 source sections

Sections are extracted automatically from the pinned SKILL.md and link back to the source.

01

Usage

Run against the current project's .claude/ directory:

SKILL.md · Usage
Run against the current project's .claude/ directory:
02

When to Activate

Setting up a new Claude Code project

SKILL.md · When to Activate
Setting up a new Claude Code projectAfter modifying .claude/settings.json, CLAUDE.md, or MCP configsBefore committing configuration changes
03

What It Scans

Review the “What It Scans” section in the pinned source before continuing.

SKILL.md · What It Scans
Review and apply the “What It Scans” source section.
04

Prerequisites

AgentShield must be installed. Check and install if needed:

SKILL.md · Prerequisites
AgentShield must be installed. Check and install if needed:
05

Check if installed

Review the “Check if installed” section in the pinned source before continuing.

SKILL.md · Check if installed
Review and apply the “Check if installed” source section.

SkillSignal prompt templates

Provide the task, context, and acceptance criteria

These prompts were written by SkillSignal from the source structure; they are not upstream text.

Task-start prompt

Confirm source fit, inputs, and outputs before acting.

Use security-scan to help me with: [specific task]. Context: [files, data, or background]. Constraints: [environment, scope, and prohibited actions]. Before acting, check the pinned SKILL.md and explain which sections apply, what inputs are still missing, and what you will deliver.

Source-guided execution

Make the Agent explicitly follow the key extracted sections.

Apply the pinned security-scan source to [task]. Pay particular attention to these source sections: “Usage”, “When to Activate”, “What It Scans”, “Prerequisites”, “Check if installed”. Preserve the important decision at each step. Mark facts not covered by the source as “needs confirmation” instead of inventing them. Then verify the result against my acceptance criteria: [criteria].

Result-review prompt

Check omissions, permissions, and source drift before delivery.

Review the current security-scan result: (1) does it satisfy the original task; (2) were any applicable steps or limits in the pinned SKILL.md missed; (3) did it perform any unauthorized file, command, network, or data action; and (4) which conclusions remain unverified? List issues first, then fix only what the source or user authorization supports.

Output checklist

Verify each item before delivery

The task matches the purpose documented in the SKILL.md.

The source section “Usage” has been checked.

The source section “When to Activate” has been checked.

The source section “What It Scans” has been checked.

The source section “Prerequisites” has been checked.

Inputs, constraints, and acceptance criteria are explicit.

Unverified facts, compatibility, and outcome claims are clearly marked.

Any file, command, network, or data action has been reviewed.

Choose a different workflow

When another Skill is the better fit

security-scan

AgentShield を使用して、Claude Code の設定（.claude/ ディレクトリ）のセキュリティ脆弱性、設定ミス、インジェクションリスクをスキャンします。CLAUDE.md、settings.json、MCP サーバー、フック、エージェント定義をチェックします。

A separate implementation from affaan-m/ECC; compare its source, maintenance signals, and permission requirements.

Open source detail

claude-skill-spec-audit

Audit skill SKILL.md files for compliance with the agentskills.io specification and house conventions. Checks frontmatter fields (name, description, compatibility, metadata, argument-hint), metadata sub-fields (author, scope, layer, confirms), and layer/suffix consistency. Use when adding new skills, reviewing skill quality, or ensuring all skills follow the spec. Triggers: "audit skills", "check skill spec", "skill compliance", "are my skills up to spec", "/claude-skill-spec-audit".

A separate implementation from jackchuka/skills; compare its source, maintenance signals, and permission requirements.

Open source detail

autonomous-loops

Patterns and architectures for autonomous Claude Code loops — from simple sequential pipelines to RFC-driven multi-agent DAG systems.

A separate implementation from affaan-m/ECC; compare its source, maintenance signals, and permission requirements.

Open source detail

FAQ

What does security-scan do?

Audit your Claude Code configuration for security issues using AgentShield.

How do I start using security-scan?

The catalog detected this source-specific install command: npx skills add https://github.com/affaan-m/ECC --skill "skills/security-scan". Inspect the command and pinned source before running it.

Which Agent platforms does it declare?

claude code

Repository stars
234,327
Repository forks
35,711
Quality
85/100
Source repository last pushed

Quality breakdown

Based on traceable docs and repository signals; stars are not treated as quality.

85/100
Documentation28/30
Specificity14/25
Maintenance20/20
Trust signals23/25

Compare before choosing

Related Agent Skills and source variants

These links are selected from shared tasks, functions, stacks, platforms, and same-name variants. Compare the source owner, documentation, permissions, and maintenance signals.

security-scan by affaan-m

AgentShield を使用して、Claude Code の設定（.claude/ ディレクトリ）のセキュリティ脆弱性、設定ミス、インジェクションリスクをスキャンします。CLAUDE.md、settings.json、MCP サーバー、フック、エージェント定義をチェックします。

claude-skill-spec-audit by jackchuka

Audit skill SKILL.md files for compliance with the agentskills.io specification and house conventions. Checks frontmatter fields (name, description, compatibility, metadata, argument-hint), metadata sub-fields (author, scope, layer, confirms), and layer/suffix consistency. Use when adding new skills, reviewing skill quality, or ensuring all skills follow the spec. Triggers: "audit skills", "check skill spec", "skill compliance", "are my skills up to spec", "/claude-skill-spec-audit".

autonomous-loops by affaan-m

Patterns and architectures for autonomous Claude Code loops — from simple sequential pipelines to RFC-driven multi-agent DAG systems.

quality-nonconformance by affaan-m

Codified expertise for quality control, non-conformance investigation, root cause analysis, corrective action, and supplier quality management in regulated manufacturing. Informed by quality engineers with 15+ years experience across FDA, IATF 16949, and AS9100 environments. Includes NCR lifecycle management, CAPA systems, SPC interpretation, and audit methodology. Use when investigating non-conformances, performing root cause analysis, managing CAPAs, interpreting SPC data, or handling supplier

configure-ecc by affaan-m

Interactive installer for Everything Claude Code — guides users through selecting and installing skills and rules to user-level or project-level directories, verifies paths, and optionally optimizes installed files.

View original Skill.mdThis page is parsed directly from the repository SKILL.md without editorial rewriting. Collected: Jul 28, 2026 · about 2 min

Security Scan Skill

Audit your Claude Code configuration for security issues using AgentShield.

When to Activate

  • Setting up a new Claude Code project
  • After modifying .claude/settings.json, CLAUDE.md, or MCP configs
  • Before committing configuration changes
  • When onboarding to a new repository with existing Claude Code configs
  • Periodic security hygiene checks

What It Scans

FileChecks
CLAUDE.mdHardcoded secrets, auto-run instructions, prompt injection patterns
settings.jsonOverly permissive allow lists, missing deny lists, dangerous bypass flags
mcp.jsonRisky MCP servers, hardcoded env secrets, npx supply chain risks
hooks/Command injection via interpolation, data exfiltration, silent error suppression
agents/*.mdUnrestricted tool access, prompt injection surface, missing model specs

Prerequisites

AgentShield must be installed. Check and install if needed:

# Check if installed
npx ecc-agentshield --version

# Install globally (recommended)
npm install -g ecc-agentshield

# Or run directly via npx (no install needed)
npx ecc-agentshield scan .

Usage

Basic Scan

Run against the current project's .claude/ directory:

# Scan current project
npx ecc-agentshield scan

# Scan a specific path
npx ecc-agentshield scan --path /path/to/.claude

# Scan with minimum severity filter
npx ecc-agentshield scan --min-severity medium

Output Formats

# Terminal output (default) — colored report with grade
npx ecc-agentshield scan

# JSON — for CI/CD integration
npx ecc-agentshield scan --format json

# Markdown — for documentation
npx ecc-agentshield scan --format markdown

# HTML — self-contained dark-theme report
npx ecc-agentshield scan --format html > security-report.html

Auto-Fix

Apply safe fixes automatically (only fixes marked as auto-fixable):

npx ecc-agentshield scan --fix

This will:

  • Replace hardcoded secrets with environment variable references
  • Tighten wildcard permissions to scoped alternatives
  • Never modify manual-only suggestions

Opus 4.6 Deep Analysis

Run the adversarial three-agent pipeline for deeper analysis:

# Requires ANTHROPIC_API_KEY
export ANTHROPIC_API_KEY=your-key
npx ecc-agentshield scan --opus --stream

This runs:

  1. Attacker (Red Team) — finds attack vectors
  2. Defender (Blue Team) — recommends hardening
  3. Auditor (Final Verdict) — synthesizes both perspectives

Initialize Secure Config

Scaffold a new secure .claude/ configuration from scratch:

npx ecc-agentshield init

Creates:

  • settings.json with scoped permissions and deny list
  • CLAUDE.md with security best practices
  • mcp.json placeholder

GitHub Action

Add to your CI pipeline:

- uses: affaan-m/agentshield@v1
  with:
    path: '.'
    min-severity: 'medium'
    fail-on-findings: true

Severity Levels

GradeScoreMeaning
A90-100Secure configuration
B75-89Minor issues
C60-74Needs attention
D40-59Significant risks
F0-39Critical vulnerabilities

Interpreting Results

Critical Findings (fix immediately)

  • Hardcoded API keys or tokens in config files
  • Bash(*) in the allow list (unrestricted shell access)
  • Command injection in hooks via ${file} interpolation
  • Shell-running MCP servers

High Findings (fix before production)

  • Auto-run instructions in CLAUDE.md (prompt injection vector)
  • Missing deny lists in permissions
  • Agents with unnecessary Bash access

Medium Findings (recommended)

  • Silent error suppression in hooks (2>/dev/null, || true)
  • Missing PreToolUse security hooks
  • npx -y auto-install in MCP server configs

Info Findings (awareness)

  • Missing descriptions on MCP servers
  • Prohibitive instructions correctly flagged as good practice

Links

Source repo
affaan-m/ECC
Skill path
skills/security-scan/SKILL.md
Commit SHA
4e973d3eaf92
Repository license
MIT
Data collected