---
description: "Run security scan against agent configuration — secrets, permissions, MCP server safety"
---

# Security Scan

Audit project configuration for security issues: hardcoded secrets, broad permissions, unsafe MCP servers.

## Usage

`/security-scan [path] [--format text|json|markdown] [--min-severity low|medium|high|critical]`

## Scanning

Uses AgentShield when available:

```bash
npx ecc-agentshield scan --path "${TARGET_PATH:-.}" --format text
```

## Checklist

- Hardcoded secrets (API keys, passwords, tokens)
- Broad permissions in agent configs
- Executable hooks
- MCP servers with shell/filesystem/remote transport
- Agent prompts handling untrusted content

## Output

- Security grade and score
- Findings by severity with exact file paths
- Remediation order
- Before/after comparison when fixes applied

## CI Integration

```yaml
- uses: affaan-m/agentshield@v1
  with:
    path: "."
    min-severity: "medium"
    fail-on-findings: true
```

## Related

- Skill: `skill://security-review`
- Agent: `security-reviewer`
- Scanner: <https://github.com/affaan-m/agentshield>
