The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the user to execute code from an external source via npx ecc-agentshield. This runs the package's logic directly on the host system without prior verification.
[EXTERNAL_DOWNLOADS]: Promotes the installation and use of a third-party NPM package ecc-agentshield from an unverified GitHub repository (affaan-m/agentshield). There is no evidence this is a well-known or trusted security utility.
[CREDENTIALS_UNSAFE]: The instructions explicitly guide the user to export their ANTHROPIC_API_KEY for use with the third-party tool's Deep Analysis feature. Providing a high-privilege API key to an unverified tool poses a significant credential theft and data exposure risk.
[COMMAND_EXECUTION]: The skill uses shell commands to perform system audits, configuration changes, and scaffolding (npx ecc-agentshield init), which can modify local environment files.
[DATA_EXPOSURE]: The skill scans for secrets in local files, meaning the third-party tool has read-access to potentially sensitive configuration files like .claude/settings.json and CLAUDE.md.

security-scan