What is SecureAI-Scan CLAUDE.md?

Instructions for SecureAI-Scan, a static security scanner for TypeScript, JavaScript, and Python. It checks source code for issues such as prompt injection, MCP supply-chain risks, retrieval-augmented-generation poisoning, and other AI-agent security problems.

Use it when modifying detection rules or scanner code, adding security checks, or running the project's safety tests and fixtures.

It sets rules for making scanner changes without adding false alarms, including tests that verify known-safe code remains clear.

SecureAI-Scan CLAUDE.md — Instructions file for coding agents by akanthed: Instructions for SecureAI-Scan, a static security scanner for Typ

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add instructions/akanthed/secureai-scan/claude-md

Clone the repo

git clone --depth 1 https://github.com/akanthed/SecureAI-Scan

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/instructions/akanthed/secureai-scan/claude-md.svg)](https://agentmods.dev/instructions/akanthed/secureai-scan/claude-md)

Your own site

<a href="https://agentmods.dev/instructions/akanthed/secureai-scan/claude-md"><img src="https://agentmods.dev/badge/instructions/akanthed/secureai-scan/claude-md.svg" alt="Measured on agentmods" height="20"></a>

Per session 4,552 This file is loaded in full into every session.

When invoked 4,552 The same file — it is already loaded in full.

Security scan B 1 finding. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.04552	$0.04552
Opus 5	$0.02276	$0.02276
Sonnet 5	$0.00910	$0.00910
Haiku 4.5	$0.00455	$0.00455

Measured 5d ago against content hash df159c6fce8f, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade B, and why

SecureAI-Scan CLAUDE.md scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Instruction-override phrasingmediumPrompt injection

Text telling the model to disregard its earlier instructions or safety rules is the shape of a prompt injection, whoever wrote it.

- **`src/scanner/deobfuscate.ts`** — content checks match against normalized *variants* (invisible-stripped, homoglyph-folded, string-splice-joined, intra-word-break-joined) instead of one byte sequence. `matchAcrossVari

Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.

CLAUDE.md · 140 lines

How it starts

The opening of the file, as written. The whole thing — 140 lines — stays where its author put it; the contents beside it link to each section on GitHub.

CLAUDE.md

This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.

What this is

secureai-scan (npm) — a static AI/LLM security scanner for TypeScript, JavaScript, and Python. It finds prompt injection, MCP supply-chain risks, RAG poisoning, Agent Skill poisoning, and related OWASP LLM/ASI/MCP Top 10 issues, and proves findings with source→flow→sink dataflow traces rather than keyword matching alone.

Hard requirements (non-negotiable, apply to every change)

1. Zero tolerance for false positives

This is the product's entire value proposition (see the "precision contract" in README.md) — a scanner nobody trusts because it cries wolf is worse than no scanner. Any change to detection logic (a rule file, tool-poisoning-checks.ts, python-scanner.ts, confidence.ts, etc.) must not introduce new false positives, and existing false positives found during work should be fixed, not worked around.

The internal precision gate (test-fixtures/safe/ + test/corpus.test.js) enforces zero proven/likely findings on known-safe patterns — this must stay green, and any bug fixed for a false positive gets a permanent fixture there so it can't regress silently.
That corpus alone is not sufficient — it only proves the scanner behaves on code we wrote to test it. See the regression-scan requirement below for the check that catches what it can't.
When you find a false positive, fix the root cause (a rule's evidence tier, an unguarded keyword match, a missing isTestFilePath demotion, an overly broad name set) rather than special-casing the one input that revealed it.

2. Test against real-world repos, not just fixtures, before calling detection work done

For any change that touches detection logic (new rule, edited rule, edited shared matcher), run:

npm run regression

This clones a curated set of real public repos (scripts/regression-scan.js — OpenAI/Anthropic/Vercel AI SDKs, official MCP servers and SDK, LlamaIndex) into .regression-cache/ (gitignored, cached across runs — pass --fresh to re-clone, or a repo name to scan just one) and scans each with the built CLI. It is a gate: it exits non-zero on any proven/likely finding whose repo|rule|file fingerprint isn't in test/regression-baseline.json. Fingerprints omit line numbers so ordinary upstream churn isn't noise. Read every new finding against its source line:

Read the full file on GitHub · 140 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

5d ago First seen · 140 lines · 4,552 tokens per session scan B df159c6fce8f

Subscribe to this mod's changes

SecureAI-Scan CLAUDE.md is an instructions file published in the GitHub repository akanthed/SecureAI-Scan (19 stars, last pushed 6d ago), licensed MIT. It adds 4,552 tokens to every session, about $0.0228 per session on Opus 5. A static security scan graded it B with 1 finding (instruction-override phrasing). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Code review LLM Prompt Injection Security ai-security devsecops mcp

SecureAI-Scan CLAUDE.md

Getting it into your agent

Wrote this? Show the measurements

What it costs to keep this loaded

Grade B, and why

Instruction-override phrasingmediumPrompt injection

How it starts

CLAUDE.md

What this is

Hard requirements (non-negotiable, apply to every change)

1. Zero tolerance for false positives

2. Test against real-world repos, not just fixtures, before calling detection work done

What this file has done since we first saw it

Other instructions, from other repositories

aigis CLAUDE.md

assay CLAUDE.md

aguara CLAUDE.md

tooltrust-scanner CLAUDE.md

claudini CLAUDE.md

MCP-Sentinel AGENTS.md