Description
security-scan is an agent skill from the ECC collection by affaan-m, listed on skills.sh. It audits a Claude Code configuration for security problems, using AgentShield. It checks the .claude directory, including settings.json, CLAUDE.md and MCP configuration, for vulnerabilities, misconfigurations and injection risks. It applies when a new Claude Code project is set up, after the settings, CLAUDE.md or MCP files change, before configuration changes are committed, when onboarding to a repository that already has Claude Code configs, and as a periodic hygiene check. The listing's security audits show a Snyk failure, while Gen Agent Trust Hub and Socket pass. Because the scan's source is the AgentShield project, the user should review that project before running the scan on sensitive setups. A skill is a SKILL.md file of instructions that an AI agent loads when a task calls for it. It is free and open source.…
Highlights
- Audits the .claude configuration
- Checks settings, CLAUDE.md and MCP configs
- Finds misconfigurations and injection risks
- Runs on setup and before commits
Ratings & Reviews
No ratings yet
Be the first to rate security-scan.
People also visit
setup-matt-pocock-skills
Configuration scaffold for engineering skills to locate issue tracker
configure-ecc
Run the conversational ECC setup wizard inside the current harness: inventory
mode-creator
Interactively create, install, activate, and verify custom claude-mem modes
content-research-writer
Assists in writing high-quality content by conducting research
security-scan FAQ
What does the security-scan skill do?
It audits your Claude Code configuration for security issues, using the AgentShield tool.
What files does it check?
The .claude directory, including settings.json, CLAUDE.md and MCP configuration.
When should I run it?
After changing those files, before committing configuration changes, and when onboarding to a repository with existing Claude configs.
How do I install it?
Run: npx skills add https://github.com/affaan-m/ecc --skill security-scan
Is it free?
Yes. It is free and open source. The scan relies on the separate AgentShield project.
Are there security warnings?
The skills.sh listing shows Snyk failing its check, while Gen Agent Trust Hub and Socket pass. Review the skill before installing it.
What are the best security-scan alternatives?
Popular alternatives to security-scan include setup-matt-pocock-skills, config-gc and configure-ecc. See all security-scan alternatives