agent-shield

Files (1)

• SKILL.md

SKILL.md (first lines)

# AgentShield Security Scanner Integration

Scans agent configurations, hooks, MCP servers, permissions, and secrets for security vulnerabilities.

---

## 1. DETERMINISTIC SCANNER

### Run AgentShield
```bash
# Using packaged scanner
npx ecc-agentshield scan --path . --format text

# Using local development
npm run scan -- --path . --format text

# Output formats
npx ecc-agentshield scan --path . --format json
npx ecc-agentshield scan --path . --format markdown
npx ecc-agentshield scan --path . --format html
```

### Filter by Severity
```bash
# Only medium and above
npx ecc-agentshield scan --path . --min-severity medium

# Only high and critical
npx ecc-agentshield scan --path . --min-severity high
```

### Auto-fix Safe Issues
```bash
# Apply safe auto-fixes
npx ecc-agentshield scan --path . --fix
```

---

## 2. SCAN TARGETS

### Agent Configurations
- `.claude/` directory
- `AGENTS.md` files
- Agent prompt files
- Permission configurations

### Hooks
- SessionStart hooks
- SessionEnd hooks
- PreToolUse hooks
- PostToolUse hooks

### MCP Servers
- Server configurations
- Shell access
- Filesystem access
- Remote transport
- Unpinned `npx` commands

### Permissions
- Tool permissions
- File access permissions
- Network access permissions

### Secrets
- Hardcoded API keys
- Hardcoded passwords
- Hardcoded tokens
- Environment variable exposure

---

## 3. REVIEW CHECKLIST

### 1. Active Runtime Findings
- Hardcoded secrets
- Broad permissions
- Executable hooks
- MCP servers with shell, filesystem, remote transport, or unpinned `npx`
- Agent prompts that handle untrusted content without defenses

### 2. Lower-Confidence Inventory
- Docs examples
- Template examples
- Plugin manifests
- Project-local optional settings

### 3. Per-Finding Details
For each critical or high finding:
- File path
- Severity
- Runtime confidence
- Why it matters
- Exact remediation
- Whether it is safe to auto-fix

---

## 4. OUTPUT CONTRACT

### Security Report
```markdown
# Security Scan Report

## Grade
- **Grade:** A
- **Score:** 92/100

## Counts by Severity
- **Critical:** 0
- **High:** 1
- **Medium:** 3
- **Low:** 5

## Critical/High Findings

### [HIGH] Hardcoded API Key
- **File:** `.opencode-plugin/hooks/post-tool-use.js:42`

From ad-free/agent-master-skills, MIT.

More from ad-free/agent-master-skills