Security Scan

affaan-m/ECC/docs/zh-CN/skills/security-scan

by affaan-mef648e01899ba3e8dc6371642deaaf64b4477775No license275K starsListed Oct 9, 2026Updated Oct 9, 2026Repository updated 4 days ago

使用AgentShield扫描您的Claude代码配置（.claude/目录），以发现安全漏洞、配置错误和注入风险。检查CLAUDE.md、settings.json、MCP服务器、钩子和代理定义。

Instructions onlySecurity
AI-generated overview

Audits Claude Code configuration files for security issues using the AgentShield scanner.

What it does
This skill guides an agent through auditing a project's .claude/ configuration with the AgentShield tool. It covers scanning CLAUDE.md, settings.json, mcp.json, hooks, and agent definitions for hardcoded secrets, overly permissive allowlists, prompt-injection patterns, and command injection. It also describes output formats, automatic fixes, an adversarial multi-agent deep analysis mode, and a GitHub Action for CI.
When to use it
Use it when setting up a new Claude Code project, after changing settings.json, CLAUDE.md, or MCP configuration, before committing configuration changes, or when joining a repository with existing Claude Code configuration. It is also intended for periodic security hygiene checks.
Requirements
Requires the AgentShield CLI, installed globally via npm or run through npx, and Node.js/npm. The deep analysis mode requires an ANTHROPIC_API_KEY. Network access is needed to fetch the package. The skill ships no scripts; it is instructions only.

安全扫描技能

使用 AgentShield 审计您的 Claude Code 配置中的安全问题。

何时激活

  • 设置新的 Claude Code 项目时
  • 修改 .claude/settings.json、CLAUDE.md 或 MCP 配置后
  • 提交配置更改前
  • 加入具有现有 Claude Code 配置的新代码库时
  • 定期进行安全卫生检查时

扫描内容

文件检查项
CLAUDE.md硬编码的密钥、自动运行指令、提示词注入模式
settings.json过于宽松的允许列表、缺失的拒绝列表、危险的绕过标志
mcp.json有风险的 MCP 服务器、硬编码的环境变量密钥、npx 供应链风险
hooks/通过 ${file} 插值导致的命令注入、数据泄露、静默错误抑制
agents/*.md无限制的工具访问、提示词注入攻击面、缺失的模型规格

先决条件

必须安装 AgentShield。检查并在需要时安装：

bash
# Check if installednpx ecc-agentshield --version
# Install globally (recommended)npm install -g ecc-agentshield
# Or run directly via npx (no install needed)npx ecc-agentshield scan .

使用方法

基础扫描

针对当前项目的 .claude/ 目录运行：

bash
# Scan current projectnpx ecc-agentshield scan
# Scan a specific pathnpx ecc-agentshield scan --path /path/to/.claude
# Scan with minimum severity filternpx ecc-agentshield scan --min-severity medium

输出格式

bash
# Terminal output (default) — colored report with gradenpx ecc-agentshield scan
# JSON — for CI/CD integrationnpx ecc-agentshield scan --format json
# Markdown — for documentationnpx ecc-agentshield scan --format markdown
# HTML — self-contained dark-theme reportnpx ecc-agentshield scan --format html > security-report.html

自动修复

自动应用安全的修复（仅修复标记为可自动修复的问题）：

bash
npx ecc-agentshield scan --fix

这将：

  • 用环境变量引用替换硬编码的密钥
  • 将通配符权限收紧为作用域明确的替代方案
  • 绝不修改仅限手动修复的建议

Opus 4.6 深度分析

运行对抗性的三智能体流程以进行更深入的分析：

bash
# Requires ANTHROPIC_API_KEYexport ANTHROPIC_API_KEY=your-keynpx ecc-agentshield scan --opus --stream

这将运行：

  1. 攻击者（红队） — 寻找攻击向量
  2. 防御者（蓝队） — 建议加固措施
  3. 审计员（最终裁决） — 综合双方观点

初始化安全配置

从头开始搭建一个新的安全 .claude/ 配置：

bash
npx ecc-agentshield init

创建：

  • 具有作用域权限和拒绝列表的 settings.json
  • 遵循安全最佳实践的 CLAUDE.md
  • mcp.json 占位符

GitHub Action

添加到您的 CI 流水线中：

yaml
- uses: affaan-m/agentshield@v1  with:    path: '.'    min-severity: 'medium'    fail-on-findings: true

严重性等级

等级分数含义
A90-100安全配置
B75-89轻微问题
C60-74需要注意
D40-59显著风险
F0-39严重漏洞

结果解读

关键发现（立即修复）

  • 配置文件中硬编码的 API 密钥或令牌
  • 允许列表中存在 Bash(*)（无限制的 shell 访问）
  • 钩子中通过 ${file} 插值导致的命令注入
  • 运行 shell 的 MCP 服务器

高优先级发现（生产前修复）

  • CLAUDE.md 中的自动运行指令（提示词注入向量）
  • 权限配置中缺少拒绝列表
  • 具有不必要 Bash 访问权限的代理

中优先级发现（建议修复）

  • 钩子中的静默错误抑制（2>/dev/null、|| true）
  • 缺少 PreToolUse 安全钩子
  • MCP 服务器配置中的 npx -y 自动安装

信息性发现（了解情况）

  • MCP 服务器缺少描述信息
  • 正确标记为良好实践的限制性指令

链接

Source and attribution

Source:affaan-m/ECCindocs/zh-CN/skills/security-scanat commitef648e0

License: No license

Content belongs to its original authors. SourceWeft indexes it from a public repository.

Report or request removal

More from affaan-m/ECC

Unified Notifications Ops

affaan-m

Designs a unified notification policy that classifies, routes, deduplicates and escalates alerts across GitHub, Linear, hooks and chat.

Productivity & Workflow275Kupdated 4 days ago

Verification Loop

affaan-m

Runs a six-phase code verification loop and produces a PASS/FAIL readiness report.

Software Development275Kupdated 4 days ago

Ui To Vue

affaan-m

Converts batches of UI design screenshots into Vue 3 components using Vant, Element Plus, or Ant Design Vue.

Software Development275Kupdated 4 days ago

Unified Memory

affaan-m

Guides agents in sharing durable context and handoffs between harnesses through the local ECC Memory Vault.

AI & Agents275Kupdated 4 days ago

Visa Doc Translate

affaan-m

OCR-translates visa document images into English and produces a bilingual PDF with the original image and translation.

Documents & Office275Kupdated 4 days ago

Team Builder

affaan-m

Interactive picker that discovers agent personas, lets a user select up to five, runs them in parallel on one task, and synthesizes the results.

AI & Agents275Kupdated 4 days ago

More in Security

Kyc Rules

anthropics

Featured

Applies a firm's KYC/AML rules grid to a parsed onboarding record, scoring risk and routing outcomes.

Security39Kupdated 2 weeks ago

Kyc Rules

anthropics

Featured

Applies a firm's KYC/AML rules grid to a parsed onboarding record, scoring risk and routing outcomes.

Security39Kupdated 2 weeks ago

Compliance Tracking

anthropics

Featured

Tracks compliance requirements, audit readiness, and evidence for frameworks such as SOC 2, ISO 27001, GDPR, HIPAA, and PCI DSS.

Security27Kupdated today

Dpop Adoption

google

Featured

Guides implementation of OAuth 2.0 DPoP (RFC 9449) sender-constrained refresh tokens for Google's OAuth platform.

Security21Kupdated yesterday

Secops Triage

google

Featured

Guides SOC analysts through triaging Google SecOps security alerts, from investigation to closure or escalation.

Security21Kupdated yesterday

Secops Investigate

google

Featured

Guides SOC analysts through deep security incident and entity investigations in Google SecOps using UDM queries and timelines.

Security21Kupdated yesterday