Security Scan
affaan-m/ECC
Scan your Claude Code configuration (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield.
使用 AgentShield 扫描您的 Claude Code 配置（.claude/ 目录）是否存在安全漏洞、配置错误和注入风险。检查项包括 CLAUDE.md、settings.json、MCP 服务器、钩子（Hooks）以及智能体（Agent）定义。
Install Security Scan
$ npx skills add xu-xiang/everything-claude-code-zh --skill security-scan -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install xu-xiang/everything-claude-code-zh security-scan --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/xu-xiang/everything-claude-code-zh.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/security-scan .claude/skills/security-scan && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "security-scan" agent skill from https://github.com/xu-xiang/everything-claude-code-zh/tree/main/skills/security-scan into .claude/skills/security-scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-scan", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/xu-xiang/everything-claude-code-zh/tree/main/skills/security-scanType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add xu-xiang/everything-claude-code-zh --skill security-scan -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install xu-xiang/everything-claude-code-zh security-scan --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/xu-xiang/everything-claude-code-zh.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/security-scan .agents/skills/security-scan && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "security-scan" agent skill from https://github.com/xu-xiang/everything-claude-code-zh/tree/main/skills/security-scan into .agents/skills/security-scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-scan", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add xu-xiang/everything-claude-code-zh --skill security-scan -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install xu-xiang/everything-claude-code-zh security-scan --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/xu-xiang/everything-claude-code-zh.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/security-scan .cursor/skills/security-scan && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "security-scan" agent skill from https://github.com/xu-xiang/everything-claude-code-zh/tree/main/skills/security-scan into .cursor/skills/security-scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-scan", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/xu-xiang/everything-claude-code-zh.git --path skills/security-scan--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add xu-xiang/everything-claude-code-zh --skill security-scan -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install xu-xiang/everything-claude-code-zh security-scan --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/xu-xiang/everything-claude-code-zh.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/security-scan .gemini/skills/security-scan && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "security-scan" agent skill from https://github.com/xu-xiang/everything-claude-code-zh/tree/main/skills/security-scan into .gemini/skills/security-scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-scan", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install xu-xiang/everything-claude-code-zh security-scanInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add xu-xiang/everything-claude-code-zh --skill security-scan -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/xu-xiang/everything-claude-code-zh.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/security-scan .github/skills/security-scan && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "security-scan" agent skill from https://github.com/xu-xiang/everything-claude-code-zh/tree/main/skills/security-scan into .github/skills/security-scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-scan", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add xu-xiang/everything-claude-code-zh --skill security-scan -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install xu-xiang/everything-claude-code-zh security-scan --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/xu-xiang/everything-claude-code-zh.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/security-scan .opencode/skills/security-scan && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "security-scan" agent skill from https://github.com/xu-xiang/everything-claude-code-zh/tree/main/skills/security-scan into .opencode/skills/security-scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-scan", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
security-scan- GitHub stars
- 2k
- Token cost
- ~771 tokens
- SKILL.md length
- 173 words
- Files
- 1
- Skills in repo
- 78
- Repo updated
- First seen
- Licence
- MIT
At a glance
使用 AgentShield 扫描您的 Claude Code 配置（.claude/ 目录）是否存在安全漏洞、配置错误和注入风险。检查项包括 CLAUDE.md、settings.json、MCP 服务器、钩子（Hooks）以及智能体（Agent）定义。
- Works in 3 steps: 攻击者（红队/Red Team） — 寻找攻击向量 → 防御者（蓝队/Blue Team） — 建议加固措施 → 审计员（最终裁决） — 综合两方观点
- Tasks that involve Security review
- SKILL.md covers 何时激活, 扫描对象, 前置条件 and 使用方法, plus 3 more sections
- Calls npx and npm; needs ANTHROPIC_API_KEY
What it does
Security Scan is an agent skill from xu-xiang/everything-claude-code-zh. 使用 AgentShield 扫描您的 Claude Code 配置（.claude/ 目录）是否存在安全漏洞、配置错误和注入风险。检查项包括 CLAUDE.md、settings.json、MCP 服务器、钩子（Hooks）以及智能体（Agent）定义。
Its SKILL.md is about 770 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Agent Workflows, covering Security review and Agent instruction files. It works with Model Context Protocol. The repository describes itself as: everything-claude-code 中文翻译项目：完整的 Claude Code 配置集合（agents, skills, hooks, commands, rules, MCPs）。源自 Anthropic 黑客松获胜者的实战配置，助力中文工程师高效理解与使用 Claude Code。 The licence is MIT.
When your agent uses it
- Tasks that involve Security review
- Tasks that involve Agent instruction files
Example prompts
- “/security-scan”
Requirements
- Node.js
- A credential in ANTHROPIC_API_KEY
Workflow steps
3 steps, taken from the first numbered list in SKILL.md.
- 攻击者（红队/Red Team） — 寻找攻击向量
- 防御者（蓝队/Blue Team） — 建议加固措施
- 审计员（最终裁决） — 综合两方观点
What it can do on your machine
Read from SKILL.md and the folder at commit dfbf946. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
npxnpm
From the folder's file list and the shell code blocks in SKILL.md.
Network
Links to these hosts (documentation or services it may open):
github.comnpmjs.com
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names these keys or tokens, usually read from environment variables:
ANTHROPIC_API_KEY
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Security Scan loads about 771 tokens when it runs. Until then it costs about 36 tokens; SKILL.md has 173 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from xu-xiang/everything-claude-code-zh at commit dfbf946, republished under its MIT licence (© xu-xiang). 173 words, ~771 tokens.
Download SKILL.mdSave it as
.claude/skills/security-scan/SKILL.md (or your agent's skills folder).- name
- security-scan
- description
- 使用 AgentShield 扫描您的 Claude Code 配置（.claude/ 目录）是否存在安全漏洞、配置错误和注入风险。检查项包括 CLAUDE.md、settings.json、MCP 服务器、钩子（Hooks）以及智能体（Agent）定义。
- origin
- ECC
安全扫描技能 (Security Scan Skill)
使用 AgentShield 审计您的 Claude Code 配置安全问题。
何时激活
- 设置新的 Claude Code 项目时
- 修改
.claude/settings.json、CLAUDE.md或 MCP 配置后 - 提交配置更改前
- 加入具有现有 Claude Code 配置的新仓库时
- 定期的安全卫生检查
扫描对象
| 文件 | 检查项 |
|---|---|
CLAUDE.md | 硬编码密钥（Hardcoded secrets）、自动运行指令、提示词注入（Prompt injection）模式 |
settings.json | 过度宽松的允许列表（Allow lists）、缺失的拒绝列表（Deny lists）、危险的绕过标志 |
mcp.json | 风险 MCP 服务器、硬编码环境变量密钥、npx 供应链风险 |
hooks/ | 通过插值进行的命令注入、数据外泄、静默错误抑制 |
agents/*.md | 未受限的工具访问、提示词注入攻击面、缺失模型规范 |
前置条件
必须安装 AgentShield。如果需要，请检查并安装：
# 检查是否已安装
npx ecc-agentshield --version
# 全局安装（推荐）
npm install -g ecc-agentshield
# 或通过 npx 直接运行（无需安装）
npx ecc-agentshield scan .使用方法
基础扫描 (Basic Scan)
针对当前项目的 .claude/ 目录运行：
# 扫描当前项目
npx ecc-agentshield scan
# 扫描特定路径
npx ecc-agentshield scan --path /path/to/.claude
# 使用最低严重程度过滤进行扫描
npx ecc-agentshield scan --min-severity medium输出格式 (Output Formats)
# 终端输出（默认） — 带有评分的彩色报告
npx ecc-agentshield scan
# JSON — 用于 CI/CD 集成
npx ecc-agentshield scan --format json
# Markdown — 用于文档记录
npx ecc-agentshield scan --format markdown
# HTML — 独立包含的深色主题报告
npx ecc-agentshield scan --format html > security-report.html自动修复 (Auto-Fix)
自动应用安全修复（仅针对标记为可自动修复的项）：
npx ecc-agentshield scan --fix此操作将：
- 将硬编码密钥替换为环境变量引用
- 将通配符权限收紧为具体范围的替代方案
- 绝不修改仅限手动建议的项
Opus 4.6 深度分析 (Opus 4.6 Deep Analysis)
运行对抗性三智能体（Three-agent）管道进行更深层次的分析：
# 需要 ANTHROPIC_API_KEY
export ANTHROPIC_API_KEY=your-key
npx ecc-agentshield scan --opus --stream此操作会运行：
- 攻击者（红队/Red Team） — 寻找攻击向量
- 防御者（蓝队/Blue Team） — 建议加固措施
- 审计员（最终裁决） — 综合两方观点
初始化安全配置 (Initialize Secure Config)
从头开始搭建一个新的安全 .claude/ 配置：
npx ecc-agentshield init创建内容：
- 带有具体权限范围和拒绝列表（Deny list）的
settings.json - 符合安全最佳实践的
CLAUDE.md mcp.json占位符
GitHub Action
添加到您的 CI 流水线：
- uses: affaan-m/agentshield@v1
with:
path: '.'
min-severity: 'medium'
fail-on-findings: true严重程度等级 (Severity Levels)
| 等级 | 评分 | 含义 |
|---|---|---|
| A | 90-100 | 安全配置 |
| B | 75-89 | 存在次要问题 |
| C | 60-74 | 需要注意 |
| D | 40-59 | 存在重大风险 |
| F | 0-39 | 存在关键漏洞 |
结果解读
关键发现（立即修复）
- 配置文件中存在硬编码的 API 密钥或令牌（Tokens）
- 允许列表（Allow list）中包含
Bash(*)（不受限的 Shell 访问） - 钩子（Hooks）中通过
${file}插值存在的命令注入 - 运行 Shell 的 MCP 服务器
高风险发现（生产环境部署前修复）
- CLAUDE.md 中的自动运行指令（提示词注入向量）
- 权限设置中缺失拒绝列表（Deny lists）
- 智能体（Agents）拥有不必要的 Bash 访问权限
中风险发现（建议修复）
- 钩子（Hooks）中的静默错误抑制（
2>/dev/null，|| true） - 缺失 PreToolUse 安全钩子（Hooks）
- MCP 服务器配置中的
npx -y自动安装
信息类发现（仅供参考）
- MCP 服务器缺失描述信息
- 预防性指令被正确标记为良好实践
相关链接
© xu-xiang, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in skills/security-scan of xu-xiang/everything-claude-code-zh.
Open the folder on GitHubat commit dfbf946
Compare with similar skills
Security Scan next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Security Scan this skillxu-xiang/everything-claude-code-zh | 2k | — | ~771 | Automated safety check: Pass | MIT | |
| Security Scanaffaan-m/ECC | 276k | 5 repos | ~1.1k | Automated safety check: Pass | MIT | |
| Security Scanaffaan-m/ECC | 276k | 2 repos | ~796 | Automated safety check: Pass | MIT | |
| Security Scanaffaan-m/ECC | 276k | 3 repos | ~738 | Automated safety check: Pass | MIT | |
| MCP Security Auditboshi-xixixi/TraeSkill | 275 | — | ~2.2k | Automated safety check: Pass | MIT | |
| Agent Setup Health Audittw93/Waza | 7.2k | — | ~5.2k | Automated safety check: Notes | MIT |
Similar skills
Security Scan
affaan-m/ECC
AgentShield を使用して、Claude Code の設定（.claude/ ディレクトリ）のセキュリティ脆弱性、設定ミス、インジェクションリスクをスキャンします。CLAUDE.md、settings.json、MCP サーバー、フック、エージェント定義をチェックします。
Security Scan
affaan-m/ECC
使用AgentShield扫描您的Claude代码配置（.claude/目录），以发现安全漏洞、配置错误和注入风险。检查CLAUDE.md、settings.json、MCP服务器、钩子和代理定义。
MCP Security Audit
boshi-xixixi/TraeSkill
Audit MCP (Model Context Protocol) server configurations for security issues.
Agent Setup Health Audit
tw93/Waza
Audits a project's agent configuration, instruction drift, hooks, MCP and AI maintainability, then reports prioritized findings with evidence and next actions.
Semantix Guide
Gnosil/semantix
Troubleshoot and configure Semantix capabilities: Skills (project/custom/global/builtin priority, discovery dirs), Commands (override order, /dir:file naming), Hooks (11 events, automatic project…
More from xu-xiang/everything-claude-code-zh
All 78 skills in this repoConfigure Ecc
xu-xiang/everything-claude-code-zh
Everything Claude Code 的交互式安装程序 — 引导用户选择并安装技能和规则到用户级或项目级目录，验证路径，并可选择优化已安装文件。
Continuous Learning V2
xu-xiang/everything-claude-code-zh
基于本能（Instinct）的学习系统，通过钩子（hooks）观察会话，创建带有置信度评分的原子本能，并将其演化为技能（Skills）、命令（Commands）或智能体（Agents）。v2.1 版本增加了项目作用域（project-scoped）的本能，以防止跨项目污染。
API Design
xu-xiang/everything-claude-code-zh
生产级 API 的 REST API 设计模式，包括资源命名、状态码、分页、过滤、错误响应、版本控制和速率限制. An agent skill from xu-xiang/everything-claude-code-zh.
Backend Patterns
xu-xiang/everything-claude-code-zh
后端架构模式、API 设计、数据库优化以及适用于 Node.js、Express 和 Next.js API 路由的服务端最佳实践。
Backend Patterns
xu-xiang/everything-claude-code-zh
后端架构模式、API 设计、数据库优化以及 Node.js、Express 和 Next.js API 路由的服务端最佳实践。
Backend Patterns
xu-xiang/everything-claude-code-zh
后端架构模式、API 设计、数据库优化以及针对 Node.js、Express 和 Next.js API 路由的服务端最佳实践。
Related
Works with
Categories
Questions about Security Scan
What does Security Scan do?
使用 AgentShield 扫描您的 Claude Code 配置（.claude/ 目录）是否存在安全漏洞、配置错误和注入风险。检查项包括 CLAUDE.md、settings.json、MCP 服务器、钩子（Hooks）以及智能体（Agent）定义。. Security Scan is an agent skill from xu-xiang/everything-claude-code-zh.
When should I use Security Scan?
Security Scan fits situations like: tasks that involve Security review; tasks that involve Agent instruction files.
How do I install Security Scan in Claude Code?
Run `npx skills add xu-xiang/everything-claude-code-zh --skill security-scan -a claude-code`. Or copy the skill folder (skills/security-scan in xu-xiang/everything-claude-code-zh) into .claude/skills/security-scan in your project. Claude Code loads it when a task matches its description.
How do I install Security Scan in Codex?
Run `npx skills add xu-xiang/everything-claude-code-zh --skill security-scan -a codex`. Or copy the skill folder (skills/security-scan in xu-xiang/everything-claude-code-zh) into .agents/skills/security-scan in your project. Codex loads it when a task matches its description.
Can I use Security Scan in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add xu-xiang/everything-claude-code-zh --skill security-scan -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/security-scan, .gemini/skills/security-scan, .github/skills/security-scan and .opencode/skills/security-scan in your project.
What does Security Scan need to run?
Going by SKILL.md and its folder, Security Scan needs the command-line tools its instructions call (npx and npm) and credentials named ANTHROPIC_API_KEY. Our summary lists: Node.js; A credential in ANTHROPIC_API_KEY.
Does Security Scan access the network?
SKILL.md names 2 domains. As links in the text: github.com and npmjs.com. This is read from the text; nothing was executed.
Is Security Scan safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Security Scan use?
Security Scan is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Security Scan use?
About 771 tokens (SKILL.md is roughly 3.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Security Scan?
Skills that share tags, products or a category with Security Scan: Security Scan (affaan-m/ECC, 276k stars), Security Scan (affaan-m/ECC, 276k stars), Security Scan (affaan-m/ECC, 276k stars) and MCP Security Audit (boshi-xixixi/TraeSkill, 275 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Security Scan?
xu-xiang (a GitHub user) maintains it in xu-xiang/everything-claude-code-zh, which has 1,976 GitHub stars. The repository holds 78 skills in this directory. The repository was last updated on March 5, 2026.
Source: xu-xiang/everything-claude-code-zh on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.