Does it work in CI/CD pipelines?

Absolutely. It supports JSON output for automation and provides a dedicated GitHub Action to fail builds if vulnerabilities are detected.

What files does the Security Scan skill check?

It audits the entire .claude directory, including CLAUDE.md, settings.json, MCP server configurations, hooks, and agent definitions.

Can this skill automatically fix security issues?

Yes, the --fix flag allows the skill to automatically apply safe remediations, such as replacing hardcoded secrets with environment variable references.

What is the Opus 4.6 Deep Analysis mode?

This is an advanced adversarial pipeline that uses three distinct AI agents—an Attacker, a Defender, and an Auditor—to find and fix complex security vectors.

Is AgentShield required to use this skill?

Yes, this skill utilizes AgentShield as the underlying engine. It can be run directly via npx or installed globally through npm.

Claude Code Security Scan

Name: Claude Code Security Scan
Author: affaan-m

byaffaan-m

•

112,919

•

Security & Testing

Audits Claude Code configuration files for security vulnerabilities, hardcoded secrets, and prompt injection risks using AgentShield.

The Security Scan skill provides an automated safety audit for your Claude Code environment, scanning the .claude directory to detect misconfigurations before they become liabilities. It analyzes CLAUDE.md, settings.json, and MCP configurations for critical issues like hardcoded API keys, overly permissive shell access, and command injection vulnerabilities. Beyond simple linting, it offers an advanced adversarial analysis mode using Opus 4.6 to simulate red-team attacks, providing actionable remediation steps and automated fixes to harden your AI agent's operational environment.

Key Features

01Automated remediation for common security misconfigurations

02Deep adversarial analysis using a multi-agent Red/Blue team pipeline

03Support for multiple output formats including JSON, Markdown, and HTML reports

04112,919 GitHub stars

05Detection of hardcoded secrets and prompt injection patterns

06Automated vulnerability scanning for .claude configuration files

Use Cases

01Hardening a new Claude Code project during initial setup

02Integrating security gates into CI/CD pipelines to prevent secret leaks

03Auditing third-party repository configurations before onboarding

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add affaan-m/everything-claude-code security-scan

For use in Claude.ai and ChatGPT

Download Skill