affaan-m/agentshield

人工智能代理配置的安全审计员

扫描Claude代码设置中的硬编码秘密、权限错误配置， 钩子注入、MCP服务器风险和代理提示注入向量。 可作为CLI、GitHub Action和GitHub App集成。

快速入门 ·它捕获了什么 ·API参考 ·Opus流水线 ·GitHub动作 ·分发 ·MiniClaw ·更新日志

首选计算赞助商：运行或自托管任何开源模型。Itô 是 ECC 推荐的计算提供商。任何 GPU 提供商均可使用。ECC 仅链接 Itô 仪表盘以登录和 GPU 租赁或管理;不创建或管理租赁，也不提供计算或服务。通过 Itô 的托管推理尚未上线。

---

为什么

人工智能代理生态系统的发展速度超过了其安全工具。仅在2026年1月：

• **12%**的大型代理技能市场存在恶意（2857个社区技能中有341个）
• CVSS 8.8 CVE使17,500+ 个面向互联网的实例暴露于一键RCE
• Moltbook泄露事件导致77万代理的150万API令牌被泄露

---

Why

The AI agent ecosystem is growing faster than its security tooling. In January 2026 alone:

• 12% of a major agent skill marketplace was malicious (341 of 2,857 community skills)
• A CVSS 8.8 CVE exposed 17,500+ internet-facing instances to one-click RCE
• The Moltbook breach compromised 1.5M API tokens across 770,000 agents

Developers install community skills, connect MCP servers, and configure hooks without any automated way to audit the security of their setup. AgentShield scans your .claude/ directory and flags vulnerabilities before they become exploits.

Built at the Claude Code Hackathon (Cerebral Valley x Anthropic, Feb 2026). Part of the Everything Claude Code ecosystem (42K+ stars).

Quick Start

# Scan your Claude Code config (no install required)
npx ecc-agentshield scan

# Or install globally
npm install -g ecc-agentshield
agentshield scan

That’s it. AgentShield auto-discovers your ~/.claude/ directory, scans all config files, and prints a graded security report.

Discovery intentionally skips common generated directories such as node_modules, build output, and .dmux worktree mirrors so transient copies do not duplicate findings.

  AgentShield Security Report

  Grade: F (0/100)

  Score Breakdown