Security Scan
xu-xiang/everything-claude-code-zh
使用 AgentShield 扫描 Claude Code 配置（.claude/ 目录）中的安全漏洞、配置错误和注入风险。检查 CLAUDE.md、settings.json、MCP 服务端、钩子（Hooks）和智能体（Agents）定义。
使用AgentShield扫描您的Claude代码配置（.claude/目录），以发现安全漏洞、配置错误和注入风险。检查CLAUDE.md、settings.json、MCP服务器、钩子和代理定义。
Install Security Scan
$ npx skills add affaan-m/ECC --skill security-scan -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install affaan-m/ECC security-scan --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/affaan-m/ECC.git skills-src && mkdir -p .claude/skills && cp -r skills-src/docs/zh-CN/skills/security-scan .claude/skills/security-scan && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "security-scan" agent skill from https://github.com/affaan-m/ECC/tree/main/docs/zh-CN/skills/security-scan into .claude/skills/security-scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-scan", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/affaan-m/ECC/tree/main/docs/zh-CN/skills/security-scanType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add affaan-m/ECC --skill security-scan -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install affaan-m/ECC security-scan --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/affaan-m/ECC.git skills-src && mkdir -p .agents/skills && cp -r skills-src/docs/zh-CN/skills/security-scan .agents/skills/security-scan && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "security-scan" agent skill from https://github.com/affaan-m/ECC/tree/main/docs/zh-CN/skills/security-scan into .agents/skills/security-scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-scan", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add affaan-m/ECC --skill security-scan -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install affaan-m/ECC security-scan --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/affaan-m/ECC.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/docs/zh-CN/skills/security-scan .cursor/skills/security-scan && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "security-scan" agent skill from https://github.com/affaan-m/ECC/tree/main/docs/zh-CN/skills/security-scan into .cursor/skills/security-scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-scan", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/affaan-m/ECC.git --path docs/zh-CN/skills/security-scan--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add affaan-m/ECC --skill security-scan -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install affaan-m/ECC security-scan --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/affaan-m/ECC.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/docs/zh-CN/skills/security-scan .gemini/skills/security-scan && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "security-scan" agent skill from https://github.com/affaan-m/ECC/tree/main/docs/zh-CN/skills/security-scan into .gemini/skills/security-scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-scan", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install affaan-m/ECC security-scanInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add affaan-m/ECC --skill security-scan -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/affaan-m/ECC.git skills-src && mkdir -p .github/skills && cp -r skills-src/docs/zh-CN/skills/security-scan .github/skills/security-scan && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "security-scan" agent skill from https://github.com/affaan-m/ECC/tree/main/docs/zh-CN/skills/security-scan into .github/skills/security-scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-scan", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add affaan-m/ECC --skill security-scan -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install affaan-m/ECC security-scan --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/affaan-m/ECC.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/docs/zh-CN/skills/security-scan .opencode/skills/security-scan && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "security-scan" agent skill from https://github.com/affaan-m/ECC/tree/main/docs/zh-CN/skills/security-scan into .opencode/skills/security-scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-scan", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
security-scan- GitHub stars
- 276k
- Used in
- 3 other repos
- Token cost
- ~738 tokens
- SKILL.md length
- 149 words
- Files
- 1
- Skills in repo
- 673
- Repo updated
- First seen
- Licence
- MIT
At a glance
使用AgentShield扫描您的Claude代码配置（.claude/目录），以发现安全漏洞、配置错误和注入风险。检查CLAUDE.md、settings.json、MCP服务器、钩子和代理定义。
- Works in 3 steps: 攻击者（红队） — 寻找攻击向量 → 防御者（蓝队） — 建议加固措施 → 审计员（最终裁决） — 综合双方观点
- Tasks that involve Security review
- SKILL.md covers 何时激活, 扫描内容, 先决条件 and 使用方法, plus 3 more sections
- Calls npx and npm; needs ANTHROPIC_API_KEY
What it does
Security Scan is an agent skill from affaan-m/ECC. 使用AgentShield扫描您的Claude代码配置（.claude/目录），以发现安全漏洞、配置错误和注入风险。检查CLAUDE.md、settings.json、MCP服务器、钩子和代理定义。
Its SKILL.md is about 740 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Agent Workflows, covering Security review and Agent instruction files. It works with Model Context Protocol. The repository describes itself as: The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond. The licence is MIT.
When your agent uses it
- Tasks that involve Security review
- Tasks that involve Agent instruction files
Example prompts
- “/security-scan”
Requirements
- Node.js
- A credential in ANTHROPIC_API_KEY
Workflow steps
3 steps, taken from the first numbered list in SKILL.md.
- 攻击者（红队） — 寻找攻击向量
- 防御者（蓝队） — 建议加固措施
- 审计员（最终裁决） — 综合双方观点
What it can do on your machine
Read from SKILL.md and the folder at commit ef648e0. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
npxnpm
From the folder's file list and the shell code blocks in SKILL.md.
Network
Links to these hosts (documentation or services it may open):
github.comnpmjs.com
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names these keys or tokens, usually read from environment variables:
ANTHROPIC_API_KEY
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Security Scan loads about 738 tokens when it runs. Until then it costs about 28 tokens; SKILL.md has 149 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from affaan-m/ECC at commit ef648e0, republished under its MIT licence (© affaan-m). 149 words, ~738 tokens.
Download SKILL.mdSave it as
.claude/skills/security-scan/SKILL.md (or your agent's skills folder).- name
- security-scan
- description
- 使用AgentShield扫描您的Claude代码配置（.claude/目录），以发现安全漏洞、配置错误和注入风险。检查CLAUDE.md、settings.json、MCP服务器、钩子和代理定义。
- origin
- ECC
安全扫描技能
使用 AgentShield 审计您的 Claude Code 配置中的安全问题。
何时激活
- 设置新的 Claude Code 项目时
- 修改
.claude/settings.json、CLAUDE.md或 MCP 配置后 - 提交配置更改前
- 加入具有现有 Claude Code 配置的新代码库时
- 定期进行安全卫生检查时
扫描内容
| 文件 | 检查项 |
|---|---|
CLAUDE.md | 硬编码的密钥、自动运行指令、提示词注入模式 |
settings.json | 过于宽松的允许列表、缺失的拒绝列表、危险的绕过标志 |
mcp.json | 有风险的 MCP 服务器、硬编码的环境变量密钥、npx 供应链风险 |
hooks/ | 通过 ${file} 插值导致的命令注入、数据泄露、静默错误抑制 |
agents/*.md | 无限制的工具访问、提示词注入攻击面、缺失的模型规格 |
先决条件
必须安装 AgentShield。检查并在需要时安装：
# Check if installed
npx ecc-agentshield --version
# Install globally (recommended)
npm install -g ecc-agentshield
# Or run directly via npx (no install needed)
npx ecc-agentshield scan .使用方法
基础扫描
针对当前项目的 .claude/ 目录运行：
# Scan current project
npx ecc-agentshield scan
# Scan a specific path
npx ecc-agentshield scan --path /path/to/.claude
# Scan with minimum severity filter
npx ecc-agentshield scan --min-severity medium输出格式
# Terminal output (default) — colored report with grade
npx ecc-agentshield scan
# JSON — for CI/CD integration
npx ecc-agentshield scan --format json
# Markdown — for documentation
npx ecc-agentshield scan --format markdown
# HTML — self-contained dark-theme report
npx ecc-agentshield scan --format html > security-report.html自动修复
自动应用安全的修复（仅修复标记为可自动修复的问题）：
npx ecc-agentshield scan --fix这将：
- 用环境变量引用替换硬编码的密钥
- 将通配符权限收紧为作用域明确的替代方案
- 绝不修改仅限手动修复的建议
Opus 4.6 深度分析
运行对抗性的三智能体流程以进行更深入的分析：
# Requires ANTHROPIC_API_KEY
export ANTHROPIC_API_KEY=your-key
npx ecc-agentshield scan --opus --stream这将运行：
- 攻击者（红队） — 寻找攻击向量
- 防御者（蓝队） — 建议加固措施
- 审计员（最终裁决） — 综合双方观点
初始化安全配置
从头开始搭建一个新的安全 .claude/ 配置：
npx ecc-agentshield init创建：
- 具有作用域权限和拒绝列表的
settings.json - 遵循安全最佳实践的
CLAUDE.md mcp.json占位符
GitHub Action
添加到您的 CI 流水线中：
- uses: affaan-m/agentshield@v1
with:
path: '.'
min-severity: 'medium'
fail-on-findings: true严重性等级
| 等级 | 分数 | 含义 |
|---|---|---|
| A | 90-100 | 安全配置 |
| B | 75-89 | 轻微问题 |
| C | 60-74 | 需要注意 |
| D | 40-59 | 显著风险 |
| F | 0-39 | 严重漏洞 |
结果解读
关键发现（立即修复）
- 配置文件中硬编码的 API 密钥或令牌
- 允许列表中存在
Bash(*)（无限制的 shell 访问） - 钩子中通过
${file}插值导致的命令注入 - 运行 shell 的 MCP 服务器
高优先级发现（生产前修复）
- CLAUDE.md 中的自动运行指令（提示词注入向量）
- 权限配置中缺少拒绝列表
- 具有不必要 Bash 访问权限的代理
中优先级发现（建议修复）
- 钩子中的静默错误抑制（
2>/dev/null、|| true） - 缺少 PreToolUse 安全钩子
- MCP 服务器配置中的
npx -y自动安装
信息性发现（了解情况）
- MCP 服务器缺少描述信息
- 正确标记为良好实践的限制性指令
链接
© affaan-m, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in docs/zh-CN/skills/security-scan of affaan-m/ECC.
Open the folder on GitHubat commit ef648e0
Used in 3 other repositories
We found 3 copies of this SKILL.md (exact, near-identical or edited) in other folders, from 3 other GitHub owners. This page covers the copy in affaan-m/ECC, which our catalogue first saw on October 7, 2026.
Compare with similar skills
Security Scan next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Security Scan this skillaffaan-m/ECC | 276k | 3 repos | ~738 | Automated safety check: Pass | MIT | |
| Security Scanxu-xiang/everything-claude-code-zh | 2k | — | ~723 | Automated safety check: Pass | MIT | |
| Security Scanxu-xiang/everything-claude-code-zh | 2k | — | ~771 | Automated safety check: Pass | MIT | |
| Agent Setup Health Audittw93/Waza | 7.2k | — | ~5.2k | Automated safety check: Notes | MIT | |
| Semantix GuideGnosil/semantix | 821 | — | ~2.1k | Automated safety check: Pass | MIT | |
| Working With Claude Code Docsobra/superpowers-developing-for-claude-code | 142 | — | ~1.5k | Automated safety check: Pass | None |
Similar skills
Security Scan
xu-xiang/everything-claude-code-zh
使用 AgentShield 扫描您的 Claude Code 配置（.claude/ 目录）是否存在安全漏洞、配置错误和注入风险。检查项包括 CLAUDE.md、settings.json、MCP 服务器、钩子（Hooks）以及智能体（Agent）定义。
Agent Setup Health Audit
tw93/Waza
Audits a project's agent configuration, instruction drift, hooks, MCP and AI maintainability, then reports prioritized findings with evidence and next actions.
Semantix Guide
Gnosil/semantix
Troubleshoot and configure Semantix capabilities: Skills (project/custom/global/builtin priority, discovery dirs), Commands (override order, /dir:file naming), Hooks (11 events, automatic project…
Working With Claude Code Docs
obra/superpowers-developing-for-claude-code
Looks up official Claude Code documentation stored as reference files instead of guessing about CLI commands, configuration, or plugin APIs.
Agnix
agent-sh/agnix
A skill your agent uses when user asks to 'lint agent configs', 'validate skills', 'check CLAUDE.md', 'validate hooks', 'lint MCP'.
More from affaan-m/ECC
All 673 skills in this repoSkill Stocktake
affaan-m/ECC
Audits your installed Claude skills and commands for quality, with a quick mode for recently changed skills and a full mode that evaluates all of them through subagents.
VideoDB Video Search and Editing
affaan-m/ECC
Ingests, indexes, searches, edits and monitors video, audio and live streams through the VideoDB Python SDK, returning stream links, clips and timestamps.
Rules Distillation
affaan-m/ECC
Scans installed skills for principles that recur across them and proposes rule-file changes: append, revise, add a section, create a file or leave as covered.
Master Agreement Generator
affaan-m/ECC
Builds DRAFT counterparty agreements from one markdown template and a small JSON spec per party, with clauses picked by the party's role.
Skill Compliance Checker
affaan-m/ECC
Measures whether agents actually follow a skill, rule or agent definition by generating scenarios at three strictness levels and scoring tool-call traces.
Continuous Learning V2
affaan-m/ECC
Instinct-based learning system that observes sessions via hooks, creates atomic instincts with confidence scoring, and evolves them into skills/commands/agents.
Related
Works with
Categories
Questions about Security Scan
What does Security Scan do?
使用AgentShield扫描您的Claude代码配置（.claude/目录），以发现安全漏洞、配置错误和注入风险。检查CLAUDE.md、settings.json、MCP服务器、钩子和代理定义。. Security Scan is an agent skill from affaan-m/ECC.
When should I use Security Scan?
Security Scan fits situations like: tasks that involve Security review; tasks that involve Agent instruction files.
How do I install Security Scan in Claude Code?
Run `npx skills add affaan-m/ECC --skill security-scan -a claude-code`. Or copy the skill folder (docs/zh-CN/skills/security-scan in affaan-m/ECC) into .claude/skills/security-scan in your project. Claude Code loads it when a task matches its description.
How do I install Security Scan in Codex?
Run `npx skills add affaan-m/ECC --skill security-scan -a codex`. Or copy the skill folder (docs/zh-CN/skills/security-scan in affaan-m/ECC) into .agents/skills/security-scan in your project. Codex loads it when a task matches its description.
Can I use Security Scan in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add affaan-m/ECC --skill security-scan -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/security-scan, .gemini/skills/security-scan, .github/skills/security-scan and .opencode/skills/security-scan in your project.
What does Security Scan need to run?
Going by SKILL.md and its folder, Security Scan needs the command-line tools its instructions call (npx and npm) and credentials named ANTHROPIC_API_KEY. Our summary lists: Node.js; A credential in ANTHROPIC_API_KEY.
Does Security Scan access the network?
SKILL.md names 2 domains. As links in the text: github.com and npmjs.com. This is read from the text; nothing was executed.
Is Security Scan safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Security Scan use?
Security Scan is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Security Scan use?
About 738 tokens (SKILL.md is roughly 3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Security Scan?
Skills that share tags, products or a category with Security Scan: Security Scan (xu-xiang/everything-claude-code-zh, 2k stars), Security Scan (xu-xiang/everything-claude-code-zh, 2k stars), Agent Setup Health Audit (tw93/Waza, 7.2k stars) and Semantix Guide (Gnosil/semantix, 821 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Security Scan?
affaan-m (a GitHub user) maintains it in affaan-m/ECC, which has 275,546 GitHub stars. The repository holds 673 skills in this directory. The repository was last updated on October 5, 2026.
Source: affaan-m/ECC on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.