security-scan
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the 'ecc-agentshield' package from the npm registry and references a GitHub Action ('affaan-m/agentshield') for CI/CD integration.
- [COMMAND_EXECUTION]: The skill provides various shell commands for scanning projects, initializing secure configurations, and applying automated fixes using the 'ecc-agentshield' CLI tool.
- [REMOTE_CODE_EXECUTION]: The usage of 'npx' to run 'ecc-agentshield' allows for the dynamic download and execution of the tool at runtime.
- [PROMPT_INJECTION]: The skill processes project configuration files which serves as an ingestion surface for potentially untrusted data.
- Ingestion points: Reads '.claude/settings.json', 'CLAUDE.md', 'mcp.json', 'hooks/', and agent definitions (SKILL.md).
- Boundary markers: Absent.
- Capability inventory: The skill can execute shell commands and modify local configuration files via its fix functionality (SKILL.md).
- Sanitization: No sanitization of the scanned content is described in the skill instructions.
Audit Metadata