Security Scan
xu-xiang/everything-claude-code-zh
使用 AgentShield 扫描 Claude Code 配置（.claude/ 目录）中的安全漏洞、配置错误和注入风险。检查 CLAUDE.md、settings.json、MCP 服务端、钩子（Hooks）和智能体（Agents）定义。
AgentShield を使用して、Claude Code の設定（.claude/ ディレクトリ）のセキュリティ脆弱性、設定ミス、インジェクションリスクをスキャンします。CLAUDE.md、settings.json、MCP サーバー、フック、エージェント定義をチェックします。
Install Security Scan
$ npx skills add affaan-m/ECC --skill security-scan -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install affaan-m/ECC security-scan --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/affaan-m/ECC.git skills-src && mkdir -p .claude/skills && cp -r skills-src/docs/ja-JP/skills/security-scan .claude/skills/security-scan && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "security-scan" agent skill from https://github.com/affaan-m/ECC/tree/main/docs/ja-JP/skills/security-scan into .claude/skills/security-scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-scan", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/affaan-m/ECC/tree/main/docs/ja-JP/skills/security-scanType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add affaan-m/ECC --skill security-scan -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install affaan-m/ECC security-scan --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/affaan-m/ECC.git skills-src && mkdir -p .agents/skills && cp -r skills-src/docs/ja-JP/skills/security-scan .agents/skills/security-scan && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "security-scan" agent skill from https://github.com/affaan-m/ECC/tree/main/docs/ja-JP/skills/security-scan into .agents/skills/security-scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-scan", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add affaan-m/ECC --skill security-scan -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install affaan-m/ECC security-scan --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/affaan-m/ECC.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/docs/ja-JP/skills/security-scan .cursor/skills/security-scan && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "security-scan" agent skill from https://github.com/affaan-m/ECC/tree/main/docs/ja-JP/skills/security-scan into .cursor/skills/security-scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-scan", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/affaan-m/ECC.git --path docs/ja-JP/skills/security-scan--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add affaan-m/ECC --skill security-scan -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install affaan-m/ECC security-scan --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/affaan-m/ECC.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/docs/ja-JP/skills/security-scan .gemini/skills/security-scan && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "security-scan" agent skill from https://github.com/affaan-m/ECC/tree/main/docs/ja-JP/skills/security-scan into .gemini/skills/security-scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-scan", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install affaan-m/ECC security-scanInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add affaan-m/ECC --skill security-scan -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/affaan-m/ECC.git skills-src && mkdir -p .github/skills && cp -r skills-src/docs/ja-JP/skills/security-scan .github/skills/security-scan && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "security-scan" agent skill from https://github.com/affaan-m/ECC/tree/main/docs/ja-JP/skills/security-scan into .github/skills/security-scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-scan", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add affaan-m/ECC --skill security-scan -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install affaan-m/ECC security-scan --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/affaan-m/ECC.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/docs/ja-JP/skills/security-scan .opencode/skills/security-scan && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "security-scan" agent skill from https://github.com/affaan-m/ECC/tree/main/docs/ja-JP/skills/security-scan into .opencode/skills/security-scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-scan", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
security-scan- GitHub stars
- 276k
- Used in
- 2 other repos
- Token cost
- ~796 tokens
- SKILL.md length
- 139 words
- Files
- 1
- Skills in repo
- 673
- Repo updated
- First seen
- Licence
- MIT
At a glance
AgentShield を使用して、Claude Code の設定（.claude/ ディレクトリ）のセキュリティ脆弱性、設定ミス、インジェクションリスクをスキャンします。CLAUDE.md、settings.json、MCP サーバー、フック、エージェント定義をチェックします。
- Works in 3 steps: 攻撃者（レッドチーム） — 攻撃ベクトルを発見 → 防御者（ブルーチーム） — 強化を推奨 → 監査人（最終判定） — 両方の観点を統合
- Tasks that involve Security review
- SKILL.md covers 起動タイミング, スキャン対象, 前提条件 and 使用方法, plus 3 more sections
- Calls npx and npm; needs ANTHROPIC_API_KEY
What it does
Security Scan is an agent skill from affaan-m/ECC. AgentShield を使用して、Claude Code の設定（.claude/ ディレクトリ）のセキュリティ脆弱性、設定ミス、インジェクションリスクをスキャンします。CLAUDE.md、settings.json、MCP サーバー、フック、エージェント定義をチェックします。
Its SKILL.md is about 800 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Agent Workflows, covering Security review and Agent instruction files. It works with Model Context Protocol. The repository describes itself as: The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond. The licence is MIT.
When your agent uses it
- Tasks that involve Security review
- Tasks that involve Agent instruction files
Example prompts
- “/security-scan”
Requirements
- Node.js
- A credential in ANTHROPIC_API_KEY
Workflow steps
3 steps, taken from the first numbered list in SKILL.md.
- 攻撃者（レッドチーム） — 攻撃ベクトルを発見
- 防御者（ブルーチーム） — 強化を推奨
- 監査人（最終判定） — 両方の観点を統合
What it can do on your machine
Read from SKILL.md and the folder at commit ef648e0. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
npxnpm
From the folder's file list and the shell code blocks in SKILL.md.
Network
Links to these hosts (documentation or services it may open):
github.comnpmjs.com
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names these keys or tokens, usually read from environment variables:
ANTHROPIC_API_KEY
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Security Scan loads about 796 tokens when it runs. Until then it costs about 39 tokens; SKILL.md has 139 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from affaan-m/ECC at commit ef648e0, republished under its MIT licence (© affaan-m). 139 words, ~796 tokens.
Download SKILL.mdSave it as
.claude/skills/security-scan/SKILL.md (or your agent's skills folder).- name
- security-scan
- description
- AgentShield を使用して、Claude Code の設定（.claude/ ディレクトリ）のセキュリティ脆弱性、設定ミス、インジェクションリスクをスキャンします。CLAUDE.md、settings.json、MCP サーバー、フック、エージェント定義をチェックします。
Security Scan Skill
AgentShield を使用して、Claude Code の設定のセキュリティ問題を監査します。
起動タイミング
- 新しい Claude Code プロジェクトのセットアップ時
.claude/settings.json、CLAUDE.md、または MCP 設定の変更後- 設定変更をコミットする前
- 既存の Claude Code 設定を持つ新しいリポジトリにオンボーディングする際
- 定期的なセキュリティ衛生チェック
スキャン対象
| ファイル | チェック内容 |
|---|---|
CLAUDE.md | ハードコードされたシークレット、自動実行命令、プロンプトインジェクションパターン |
settings.json | 過度に寛容な許可リスト、欠落した拒否リスト、危険なバイパスフラグ |
mcp.json | リスクのある MCP サーバー、ハードコードされた環境シークレット、npx サプライチェーンリスク |
hooks/ | 補間によるコマンドインジェクション、データ流出、サイレントエラー抑制 |
agents/*.md | 無制限のツールアクセス、プロンプトインジェクション表面、欠落したモデル仕様 |
前提条件
AgentShield がインストールされている必要があります。確認し、必要に応じてインストールします：
# インストール済みか確認
npx ecc-agentshield --version
# グローバルにインストール（推奨）
npm install -g ecc-agentshield
# または npx 経由で直接実行（インストール不要）
npx ecc-agentshield scan .使用方法
基本スキャン
現在のプロジェクトの .claude/ ディレクトリに対して実行します：
# 現在のプロジェクトをスキャン
npx ecc-agentshield scan
# 特定のパスをスキャン
npx ecc-agentshield scan --path /path/to/.claude
# 最小深刻度フィルタでスキャン
npx ecc-agentshield scan --min-severity medium出力フォーマット
# ターミナル出力（デフォルト） — グレード付きのカラーレポート
npx ecc-agentshield scan
# JSON — CI/CD 統合用
npx ecc-agentshield scan --format json
# Markdown — ドキュメント用
npx ecc-agentshield scan --format markdown
# HTML — 自己完結型のダークテーマレポート
npx ecc-agentshield scan --format html > security-report.html自動修正
安全な修正を自動的に適用します（自動修正可能とマークされた修正のみ）：
npx ecc-agentshield scan --fixこれにより以下が実行されます：
- ハードコードされたシークレットを環境変数参照に置き換え
- ワイルドカード権限をスコープ付き代替に厳格化
- 手動のみの提案は変更しない
Opus 4.6 ディープ分析
より深い分析のために敵対的な3エージェントパイプラインを実行します：
# ANTHROPIC_API_KEY が必要
export ANTHROPIC_API_KEY=your-key
npx ecc-agentshield scan --opus --streamこれにより以下が実行されます：
- 攻撃者（レッドチーム） — 攻撃ベクトルを発見
- 防御者（ブルーチーム） — 強化を推奨
- 監査人（最終判定） — 両方の観点を統合
安全な設定の初期化
新しい安全な .claude/ 設定をゼロから構築します：
npx ecc-agentshield init作成されるもの：
- スコープ付き権限と拒否リストを持つ
settings.json - セキュリティベストプラクティスを含む
CLAUDE.md mcp.jsonプレースホルダー
GitHub Action
CI パイプラインに追加します：
- uses: affaan-m/agentshield@v1
with:
path: '.'
min-severity: 'medium'
fail-on-findings: true深刻度レベル
| グレード | スコア | 意味 |
|---|---|---|
| A | 90-100 | 安全な設定 |
| B | 75-89 | 軽微な問題 |
| C | 60-74 | 注意が必要 |
| D | 40-59 | 重大なリスク |
| F | 0-39 | クリティカルな脆弱性 |
結果の解釈
クリティカルな発見（即座に修正）
- 設定ファイル内のハードコードされた API キーまたはトークン
- 許可リスト内の
Bash(*)（無制限のシェルアクセス） ${file}補間によるフック内のコマンドインジェクション- シェルを実行する MCP サーバー
高い発見（本番前に修正）
- CLAUDE.md 内の自動実行命令（プロンプトインジェクションベクトル）
- 権限内の欠落した拒否リスト
- 不要な Bash アクセスを持つエージェント
中程度の発見（推奨）
- フック内のサイレントエラー抑制（
2>/dev/null、|| true） - 欠落した PreToolUse セキュリティフック
- MCP サーバー設定内の
npx -y自動インストール
情報の発見（認識）
- MCP サーバーの欠落した説明
- 正しくフラグ付けされた禁止命令（グッドプラクティス）
リンク
© affaan-m, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in docs/ja-JP/skills/security-scan of affaan-m/ECC.
Open the folder on GitHubat commit ef648e0
Used in 2 other repositories
We found 2 copies of this SKILL.md (exact, near-identical or edited) in other folders, from 2 other GitHub owners. This page covers the copy in affaan-m/ECC, which our catalogue first saw on October 7, 2026.
Compare with similar skills
Security Scan next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Security Scan this skillaffaan-m/ECC | 276k | 2 repos | ~796 | Automated safety check: Pass | MIT | |
| Security Scanxu-xiang/everything-claude-code-zh | 2k | — | ~723 | Automated safety check: Pass | MIT | |
| Security Scanxu-xiang/everything-claude-code-zh | 2k | — | ~771 | Automated safety check: Pass | MIT | |
| MCP Security Auditboshi-xixixi/TraeSkill | 275 | — | ~2.2k | Automated safety check: Pass | MIT | |
| Agent Setup Health Audittw93/Waza | 7.2k | — | ~5.2k | Automated safety check: Notes | MIT | |
| Semantix GuideGnosil/semantix | 821 | — | ~2.1k | Automated safety check: Pass | MIT |
Similar skills
Security Scan
xu-xiang/everything-claude-code-zh
使用 AgentShield 扫描您的 Claude Code 配置（.claude/ 目录）是否存在安全漏洞、配置错误和注入风险。检查项包括 CLAUDE.md、settings.json、MCP 服务器、钩子（Hooks）以及智能体（Agent）定义。
MCP Security Audit
boshi-xixixi/TraeSkill
Audit MCP (Model Context Protocol) server configurations for security issues.
Agent Setup Health Audit
tw93/Waza
Audits a project's agent configuration, instruction drift, hooks, MCP and AI maintainability, then reports prioritized findings with evidence and next actions.
Semantix Guide
Gnosil/semantix
Troubleshoot and configure Semantix capabilities: Skills (project/custom/global/builtin priority, discovery dirs), Commands (override order, /dir:file naming), Hooks (11 events, automatic project…
Working With Claude Code Docs
obra/superpowers-developing-for-claude-code
Looks up official Claude Code documentation stored as reference files instead of guessing about CLI commands, configuration, or plugin APIs.
More from affaan-m/ECC
All 673 skills in this repoSkill Stocktake
affaan-m/ECC
Audits your installed Claude skills and commands for quality, with a quick mode for recently changed skills and a full mode that evaluates all of them through subagents.
VideoDB Video Search and Editing
affaan-m/ECC
Ingests, indexes, searches, edits and monitors video, audio and live streams through the VideoDB Python SDK, returning stream links, clips and timestamps.
Rules Distillation
affaan-m/ECC
Scans installed skills for principles that recur across them and proposes rule-file changes: append, revise, add a section, create a file or leave as covered.
Master Agreement Generator
affaan-m/ECC
Builds DRAFT counterparty agreements from one markdown template and a small JSON spec per party, with clauses picked by the party's role.
Skill Compliance Checker
affaan-m/ECC
Measures whether agents actually follow a skill, rule or agent definition by generating scenarios at three strictness levels and scoring tool-call traces.
Continuous Learning V2
affaan-m/ECC
Instinct-based learning system that observes sessions via hooks, creates atomic instincts with confidence scoring, and evolves them into skills/commands/agents.
Related
Works with
Categories
Questions about Security Scan
What does Security Scan do?
AgentShield を使用して、Claude Code の設定（.claude/ ディレクトリ）のセキュリティ脆弱性、設定ミス、インジェクションリスクをスキャンします。CLAUDE.md、settings.json、MCP サーバー、フック、エージェント定義をチェックします。. Security Scan is an agent skill from affaan-m/ECC.
When should I use Security Scan?
Security Scan fits situations like: tasks that involve Security review; tasks that involve Agent instruction files.
How do I install Security Scan in Claude Code?
Run `npx skills add affaan-m/ECC --skill security-scan -a claude-code`. Or copy the skill folder (docs/ja-JP/skills/security-scan in affaan-m/ECC) into .claude/skills/security-scan in your project. Claude Code loads it when a task matches its description.
How do I install Security Scan in Codex?
Run `npx skills add affaan-m/ECC --skill security-scan -a codex`. Or copy the skill folder (docs/ja-JP/skills/security-scan in affaan-m/ECC) into .agents/skills/security-scan in your project. Codex loads it when a task matches its description.
Can I use Security Scan in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add affaan-m/ECC --skill security-scan -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/security-scan, .gemini/skills/security-scan, .github/skills/security-scan and .opencode/skills/security-scan in your project.
What does Security Scan need to run?
Going by SKILL.md and its folder, Security Scan needs the command-line tools its instructions call (npx and npm) and credentials named ANTHROPIC_API_KEY. Our summary lists: Node.js; A credential in ANTHROPIC_API_KEY.
Does Security Scan access the network?
SKILL.md names 2 domains. As links in the text: github.com and npmjs.com. This is read from the text; nothing was executed.
Is Security Scan safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Security Scan use?
Security Scan is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Security Scan use?
About 796 tokens (SKILL.md is roughly 3.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Security Scan?
Skills that share tags, products or a category with Security Scan: Security Scan (xu-xiang/everything-claude-code-zh, 2k stars), Security Scan (xu-xiang/everything-claude-code-zh, 2k stars), MCP Security Audit (boshi-xixixi/TraeSkill, 275 stars) and Agent Setup Health Audit (tw93/Waza, 7.2k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Security Scan?
affaan-m (a GitHub user) maintains it in affaan-m/ECC, which has 275,546 GitHub stars. The repository holds 673 skills in this directory. The repository was last updated on October 5, 2026.
Source: affaan-m/ECC on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.