security-scan
by affaan-mThe security-scan skill audits your Claude Code .claude/ configuration for secrets, risky MCP setup, injection-prone instructions, dangerous bypass flags, and weak agent or hook definitions using AgentShield. Use it for repeatable security checks before committing or onboarding.
This skill scores 78/100, which means it is a solid listing candidate for directory users who want a focused security audit of Claude Code configuration. It gives enough concrete workflow guidance to install with reasonable confidence, though users should note it depends on an external tool and could use tighter quick-start packaging.
- Clear activation scenarios for new projects, config changes, commits, onboarding, and periodic checks.
- Specific scan coverage across CLAUDE.md, settings.json, mcp.json, hooks, and agents/*.md, which helps agents understand exactly what to inspect.
- Practical usage guidance with AgentShield install/run commands and explicit security checks like secrets, injection patterns, risky MCP servers, and command injection.
- Requires AgentShield to be installed, so the skill is not fully self-contained.
- No support files or install command are present, which may leave some setup and execution details to the user.
Overview of security-scan skill
What security-scan does
The security-scan skill audits a Claude Code project’s .claude/ configuration for security risks using AgentShield. It looks for secrets, risky MCP server setup, injection-prone instructions, dangerous bypass flags, and weak agent or hook definitions.
Who should install it
Use the security-scan skill if you maintain Claude Code configs, review AI agent setups, or need a repeatable security check before committing changes. It is most useful for repo owners, platform engineers, and anyone onboarding to an existing project with unknown .claude hygiene.
Why it matters in practice
A generic prompt can miss config-specific threats. This skill is aimed at the real job: quickly deciding whether a Claude Code setup is safe enough to trust, and identifying where the risk lives so you can fix it before it spreads.
How to Use security-scan skill
Install and confirm the toolchain
For security-scan install, add the skill from the directory’s repo path:
npx skills add affaan-m/everything-claude-code --skill security-scan
Then confirm AgentShield is available:
npx ecc-agentshield --version
If needed, install it globally with npm install -g ecc-agentshield, or run scans directly with npx ecc-agentshield scan ..
Give the skill the right input
The security-scan usage works best when you point it at a specific Claude Code workspace and describe the change you are reviewing. Strong input looks like: “Scan this repo’s .claude/ folder after the new MCP server and hook updates, and flag any secret exposure, injection paths, or overbroad tool access.”
Read the files in this order
Start with SKILL.md, then inspect CLAUDE.md, .claude/settings.json, mcp.json, hooks/, and agents/*.md. That order matches the scan surface and helps you map findings back to the exact config file instead of treating the output as a generic security report.
Use a review loop, not a one-off run
Run the scan before commit, after config edits, and during onboarding to a repo. For security-scan for Security Audit, focus on whether each finding changes trust: secrets should be removed, risky commands should be narrowed, and any prompt-injection exposure should be rewritten as explicit constraints.
security-scan skill FAQ
Is security-scan only for Claude Code users?
Yes. This skill is built around Claude Code configuration in .claude/, not general application security scanning or source-code vulnerability hunting.
What makes it different from a normal prompt?
A normal prompt may ask for a security review, but security-scan encodes the exact surfaces to check: CLAUDE.md, settings, MCP servers, hooks, and agent files. That makes it better for repeatable reviews and less dependent on the model guessing what “security” means.
Is it beginner-friendly?
Yes, if you can identify the repo’s Claude Code config files. The main limitation is that it assumes you can act on findings like risky shell interpolation, permissive allow lists, or exposed secrets.
When should I not use it?
Do not use security-scan as a substitute for application vulnerability testing, dependency auditing, or secrets scanning across the whole codebase. It is best when the security question is specifically about Claude Code configuration.
How to Improve security-scan skill
Make the scan scope explicit
The best security-scan results come from naming the exact directory, branch, or config change. “Scan .claude/” is useful; “review my repo” is too broad and increases the chance of shallow findings.
Provide the change you fear most
Tell the skill what changed: a new MCP server, a modified hook, a new agent, or a settings tweak. That helps it weigh the most likely failure mode instead of reporting everything with the same priority.
Ask for decision-grade output
If you want better security-scan usage, request findings in a fix-first format: file, risk, why it matters, and the smallest safe change. That reduces ambiguity and makes it easier to patch configs without overcorrecting.
Iterate after the first pass
After the first run, rescan only the files you changed. For a security-scan guide that produces better results over time, treat each finding as a prompt to tighten allow lists, remove risky instructions, or simplify hooks before the next review.