security-scan
Run AgentShield against agent, hook, MCP, permission, and secret surfaces.
- Kind
- Prompt
- Works with
- Claude Code, Codex
- Source
- affaan-m/ECC @ d3b8a3e90890
- Path
- commands/security-scan.md
- License
- MIT
- Jobs
- Guardrails
InstallCopy it from the source repository, or sign in and let the assistant adapt it for your project.
# Security Scan Command
Run AgentShield against the current project or a target path, then turn the findings into a prioritized remediation plan.
## Usage
`/security-scan [path] [--format text|json|markdown|html] [--min-severity low|medium|high|critical] [--fix]`
- `path` (optional): defaults to the current project. Use a `.claude/` path, a repo root, or a checked-in template directory.
- `--format`: output format. Use `json` for CI, `markdown` for handoffs, and `html` for standalone review reports.
- `--min-severity`: filters lower-priority findings.
- `--fix`: applies only AgentShield fixes explicitly marked as safe and auto-fixable.
## Deterministic Engine
Prefer the packaged scanner:
```bash
npx ecc-agentshield scan --path "${TARGET_PATH:-.}" --format text
```
For local AgentShield development, run from the AgentShield checkout:
```bash
npm run scan -- --path "${TARGET_PATH:-.}" --format text
```
Do not invent findings. Use AgentShield output as the source of truth and separate scanner facts from follow-up judgment.
## Review Checklist
1. Identify active runtime findings first:
- hardcoded secrets
- broad permissions
- executable hooks
…