A comprehensive security auditing tool for Claude Code configurations designed to detect vulnerabilities, misconfigurations, and injection risks.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install claude-code-security-scan
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install claude-code-security-scan using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Claude Code Security Scan?
The Claude Code Security Scan is a robust auditing utility powered by AgentShield, specifically designed to protect your AI agent ecosystem. As part of the broader library of Openclaw Skills, it analyzes settings, Model Context Protocol (MCP) servers, and hooks to prevent prompt injection, data exfiltration, and unauthorized shell access.
By integrating this tool into your development lifecycle, you ensure that your Claude Code project remains compliant with security best practices. It proactively identifies hardcoded secrets in config files and flags overly permissive settings that could lead to system compromise, making it a vital asset for developers utilizing Openclaw Skills for automated workflows.
Claude Code Security Scan Use Cases
- Initializing a new Claude Code project to ensure a secure baseline configuration.
- Auditing MCP configurations and server lists for risky integrations or hardcoded environment variables.
- Scanning CLAUDE.md files for potential prompt injection patterns or insecure auto-run instructions.
- Pre-commit security hygiene checks to prevent accidental leaks of API keys in repository settings.
- Onboarding to a new repository with existing AI agent configurations that need verification.
How Claude Code Security Scan Works
- The tool parses your .claude directory, targeting settings.json, mcp.json, and CLAUDE.md files.
- It executes a comprehensive vulnerability scan against known attack vectors like command injection and permissive tool access.
- If deep analysis is enabled via API, it leverages LLM capabilities to identify subtle logic flaws in agent instructions.
- It generates a detailed security report with a letter-grade score (A-F) based on the severity of findings.
- It provides actionable remediation steps or automatic fixes for common configuration errors found in Openclaw Skills setups.
Claude Code Security Scan Setup
# Install the security scanner globally via npm
npm install -g ecc-agentshield
# Alternatively, run instantly using npx without installation
npx ecc-agentshield scan
# Initialize a secure configuration template for your project
npx ecc-agentshield init
Claude Code Security Scan Data Schema & Taxonomy
| Component | Scope of Analysis |
|---|---|
| CLAUDE.md | Scans for hardcoded secrets, auto-run instructions, and injection patterns. |
| settings.json | Analyzes overly permissive allow lists and missing deny lists. |
| mcp.json | Reviews MCP server environments for hardcoded credentials and risky servers. |
| hooks/ | Identifies command injection risks via file interpolation. |
| agents/ | Validates unrestricted tool access and missing model specifications. |
Claude Code Security Scan Advanced Features
- Automated fixing of safe security issues using the --fix flag for rapid remediation.
- Deep analysis support via Claude Opus for complex vulnerability detection and streaming output.
- Multi-format reporting including JSON, Markdown, and HTML for seamless CI/CD integration.
- Severity filtering to prioritize critical findings and high-risk misconfigurations in Openclaw Skills.
- Custom path-specific scanning for localized or non-standard Claude Code project environments.
SKILL.md
Loading
Related Openclaw Skills
Data Analyst Pro
A professional-grade AI skill pack for automating SQL generation, Python-based data analysis, and visual business reporting.
Meditation App Promo Video
A professional AI video generation tool designed to create emotionally resonant promotional content and App Store previews for meditation and mindfulness applications.
Fake Completion Diagnosis (VeriClaw)
A diagnostic intent alias for VeriClaw that identifies and resolves instances where AI agents falsely claim to have completed a task.
Fund AI Assistant
A local-first investment tracking tool that leverages LLMs for deep quantitative fund analysis and automated portfolio management.
Outlook via Maton Gateway
Access and manage Microsoft Outlook email, calendar, and contacts via the Maton Gateway for seamless AI agent integration.
K-line Master
A comprehensive AI trading toolkit for pattern recognition, indicator analysis, and automated risk-managed trade planning.
Featured*
