security-scanning
AgentShield security audit with 5 scanning categories, 102 static analysis rules, and optional red-team simulation.
npx skills add a5c-ai/babysitter --skill security-scanning --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
- AWS access keys (AKIA pattern) - GitHub tokens (ghp_, gho_, ghs_, ghr_) - Generic API keys and bearer tokens - Database connection strings with credentials - Private keys (RSA, EC, SSH) - JWT secrets and signing keys - OAuth client secrets - Slack tokens and webhooks - Cloud provider credentials (GCP, Azure) ### 2. Permission Auditing - File system read/write scope - Network calls and protocols - Process execution (child_process) - File permissions (777, world-writable) - CORS and CSP headers - Docker privilege escalation ### 3. Hook Injection Analysis - Git hooks for command injection - npm lifecycle scripts (preinstall, postinstall) - Claude Code hooks for unsafe patterns - eval()/Function()/dynamic code execution - Unvalidated user input in shell commands ### 4. MCP Risk Profiling - Tool permission inventory - Data exposure risk mapping - Transport security (stdio vs SSE vs HTTP) - Prompt injection via tool descriptions - Rate limiting verification ### 5. Agent Config Review - Model settings integrity - Prompt injection resistance - Tool allowlist scoping - Output validation and sanitization - Information leakage in error messages ## Optional: Red Team Simulation - Attack simu
- 2. Permission Auditing
- 3. Hook Injection Analysis
- 4. MCP Risk Profiling
- 5. Agent Config Review
- Optional: Red Team Simulation
- When to Use
- Agents Used
What does the security-scanning skill do?
AgentShield security audit with 5 scanning categories, 102 static analysis rules, and optional red-team simulation.
How do I install it?
Run `npx skills add a5c-ai/babysitter --skill security-scanning --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From a5c-ai/babysitter, a repository with 1,642 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.