@funnycode/myclaude 0.1.71 → 0.1.73

package/seed/marketplaces/ecc/commands/security-scan.md

@@ -1,92 +1,92 @@
----
-description: Run AgentShield against agent, hook, MCP, permission, and secret surfaces.
-agent: everything-claude-code:security-reviewer
-subtask: true
----
-
-# Security Scan Command
-
-Run AgentShield against the current project or a target path, then turn the findings into a prioritized remediation plan.
-
-## Usage
-
-`/security-scan [path] [--format text|json|markdown|html] [--min-severity low|medium|high|critical] [--fix]`
-
-- `path` (optional): defaults to the current project. Use a `.claude/` path, a repo root, or a checked-in template directory.
-- `--format`: output format. Use `json` for CI, `markdown` for handoffs, and `html` for standalone review reports.
-- `--min-severity`: filters lower-priority findings.
-- `--fix`: applies only AgentShield fixes explicitly marked as safe and auto-fixable.
-
-## Deterministic Engine
-
-Prefer the packaged scanner:
-
-```bash
-npx ecc-agentshield scan --path "${TARGET_PATH:-.}" --format text
-```
-
-For local AgentShield development, run from the AgentShield checkout:
-
-```bash
-npm run scan -- --path "${TARGET_PATH:-.}" --format text
-```
-
-Do not invent findings. Use AgentShield output as the source of truth and separate scanner facts from follow-up judgment.
-
-## Review Checklist
-
-1. Identify active runtime findings first:
-   - hardcoded secrets
-   - broad permissions
-   - executable hooks
-   - MCP servers with shell, filesystem, remote transport, or unpinned `npx`
-   - agent prompts that handle untrusted content without defenses
-2. Separate lower-confidence inventory:
-   - docs examples
-   - template examples
-   - plugin manifests
-   - project-local optional settings
-3. For each critical or high finding, return:
-   - file path
-   - severity
-   - runtime confidence
-   - why it matters
-   - exact remediation
-   - whether it is safe to auto-fix
-4. If `--fix` is requested, state the planned edits before applying fixes.
-5. Re-run the scan after fixes and report the before/after score.
-
-## Output Contract
-
-Return:
-
-1. Security grade and score.
-2. Counts by severity and runtime confidence.
-3. Critical/high findings with exact paths.
-4. Lower-confidence findings grouped separately.
-5. A remediation order.
-6. Commands run and whether the scan was local, CI, or npx-backed.
-
-## CI Pattern
-
-Use AgentShield in GitHub Actions for enforced gates:
-
-```yaml
-- uses: affaan-m/agentshield@v1
-  with:
-    path: "."
-    min-severity: "medium"
-    fail-on-findings: true
-```
-
-## Links
-
-- Skill: `skills/security-scan/SKILL.md`
-- Agent: `agents/security-reviewer.md`
-- Scanner: <https://github.com/affaan-m/agentshield>
-
-## Arguments
-
-$ARGUMENTS:
-- optional target path
-- optional AgentShield flags
+---
+description: Run AgentShield against agent, hook, MCP, permission, and secret surfaces.
+agent: everything-claude-code:security-reviewer
+subtask: true
+---
+
+# Security Scan Command
+
+Run AgentShield against the current project or a target path, then turn the findings into a prioritized remediation plan.
+
+## Usage
+
+`/security-scan [path] [--format text|json|markdown|html] [--min-severity low|medium|high|critical] [--fix]`
+
+- `path` (optional): defaults to the current project. Use a `.claude/` path, a repo root, or a checked-in template directory.
+- `--format`: output format. Use `json` for CI, `markdown` for handoffs, and `html` for standalone review reports.
+- `--min-severity`: filters lower-priority findings.
+- `--fix`: applies only AgentShield fixes explicitly marked as safe and auto-fixable.
+
+## Deterministic Engine
+
+Prefer the packaged scanner:
+
+```bash
+npx ecc-agentshield scan --path "${TARGET_PATH:-.}" --format text
+```
+
+For local AgentShield development, run from the AgentShield checkout:
+
+```bash
+npm run scan -- --path "${TARGET_PATH:-.}" --format text
+```
+
+Do not invent findings. Use AgentShield output as the source of truth and separate scanner facts from follow-up judgment.
+
+## Review Checklist
+
+1. Identify active runtime findings first:
+   - hardcoded secrets
+   - broad permissions
+   - executable hooks
+   - MCP servers with shell, filesystem, remote transport, or unpinned `npx`
+   - agent prompts that handle untrusted content without defenses
+2. Separate lower-confidence inventory:
+   - docs examples
+   - template examples
+   - plugin manifests
+   - project-local optional settings
+3. For each critical or high finding, return:
+   - file path
+   - severity
+   - runtime confidence
+   - why it matters
+   - exact remediation
+   - whether it is safe to auto-fix
+4. If `--fix` is requested, state the planned edits before applying fixes.
+5. Re-run the scan after fixes and report the before/after score.
+
+## Output Contract
+
+Return:
+
+1. Security grade and score.
+2. Counts by severity and runtime confidence.
+3. Critical/high findings with exact paths.
+4. Lower-confidence findings grouped separately.
+5. A remediation order.
+6. Commands run and whether the scan was local, CI, or npx-backed.
+
+## CI Pattern
+
+Use AgentShield in GitHub Actions for enforced gates:
+
+```yaml
+- uses: affaan-m/agentshield@v1
+  with:
+    path: "."
+    min-severity: "medium"
+    fail-on-findings: true
+```
+
+## Links
+
+- Skill: `skills/security-scan/SKILL.md`
+- Agent: `agents/security-reviewer.md`
+- Scanner: <https://github.com/affaan-m/agentshield>
+
+## Arguments
+
+$ARGUMENTS:
+- optional target path
+- optional AgentShield flags