security-scan

Security Scan

Run AgentShield to audit .claude/ configurations for vulnerabilities (102 rules, 5 categories), then report the score and findings.

Target

$ARGUMENTS

Hard Rules

• Report ONLY what the scanner actually output — never invent a score, grade, or finding. If the scan cannot run or exits with an error, report that error and stop.
• AgentShield grades on its own scale critical / high / medium / low. Relay it verbatim; do NOT remap it to the kit's CRITICAL / WARNING / SUGGESTION.
• Run the scan at most once, using the single Step 2 command that matches the flags in Target.
• --opus needs ANTHROPIC_API_KEY set in the environment; if it is unset, run without --opus and say so.
• Emit the report only after the scan command has actually returned.

Step 1 — Check AgentShield availability

npx ecc-agentshield --version

Branch on the result:

• Prints a version → installed; go to Step 2.
• Errors because the package is not cached yet → npx will download ecc-agentshield on first run in Step 2; go to Step 2.
• npx unavailable, no network, or download fails → report AgentShield unavailable: <error> and stop. Do not fabricate results.

Done when: you know whether the scan can run.

Step 2 — Run the scan

Select ONE command by the flags in Target (flags are independent; if Target names more than one, append each form to the single scan command):

Flag in Target	Command
(none)	npx ecc-agentshield scan
--fix	npx ecc-agentshield scan --fix — auto-remediate safe issues
--opus	npx ecc-agentshield scan --opus --stream — AI deep analysis (needs ANTHROPIC_API_KEY)
--format json	npx ecc-agentshield scan --format json — for CI integration
--format markdown	npx ecc-agentshield scan --format markdown — for reports

If the command exits non-zero for a reason other than findings-present (e.g. a crash), report the exit code and stderr; do not invent a score.