# How to Implement Security Scanning in ECC Workflows

> Implement security scanning in ECC workflows using the native /security-scan command. Analyze agents, hooks, and secrets with AgentShield for a graded remediation plan in local dev and CI/CD.

- Repository: [Affaan Mustafa/ECC](https://github.com/affaan-m/ECC)
- Tags: how-to-guide
- Published: 2026-05-26

---

**ECC (Everything Claude Code) provides a native `/security-scan` command that executes AgentShield to analyze agents, hooks, MCP configurations, and secret usage, delivering a graded remediation plan that integrates seamlessly into both local development and CI/CD pipelines.**

Everything Claude Code (ECC) ships with built-in security scanning capabilities designed to automatically vet AI agent configurations before they reach production. Implementing security scanning in ECC workflows allows development teams to detect hard-coded secrets, excessive permissions, and vulnerable dependencies across their agent ecosystems by leveraging the deterministic scanning engine defined in [`commands/security-scan.md`](https://github.com/affaan-m/ECC/blob/main/commands/security-scan.md). The system analyzes your repository against a comprehensive security checklist stored in [`skills/security-review/SKILL.md`](https://github.com/affaan-m/ECC/blob/main/skills/security-review/SKILL.md), providing immediate feedback and optional automated remediation.

## Architecture of the ECC Security Scanner

The security scanning capability is composed of three interconnected components that work together to provide comprehensive coverage.

### The security-scan Command

The primary entry point resides in **[`commands/security-scan.md`](https://github.com/affaan-m/ECC/blob/main/commands/security-scan.md)**, which defines the CLI syntax and wraps the AgentShield engine. This command accepts parameters for output formatting (`--format`), severity thresholds (`--min-severity`), and automated remediation (`--fix`). According to the source implementation, the command defaults to the repository root (`.`) and produces structured output including a security grade, severity breakdown, and prioritized remediation actions【/commands/security-scan.md#L36-L67】.

### The security-review Skill

The validation logic is encapsulated in **[`skills/security-review/SKILL.md`](https://github.com/affaan-m/ECC/blob/main/skills/security-review/SKILL.md)**, which enumerates the specific security checks performed during scanning. This skill defines the checklist that validates against hard-coded secrets, broad permissions, unpinned `npx` executions, and other common agent-related vulnerabilities【/skills/security-review/SKILL.md】.

### The security-reviewer Agent

For interactive troubleshooting and remediation guidance, ECC provides **[`agents/security-reviewer.md`](https://github.com/affaan-m/ECC/blob/main/agents/security-reviewer.md)**. This agent can be invoked directly to answer questions about specific findings, explain remediation steps, or provide context about security policies【/agents/security-reviewer.md】.

## Running Local Security Scans

Developers can execute security scanning locally before committing code to catch vulnerabilities early in the development cycle.

To run a comprehensive scan on the entire repository with human-readable output:

```bash
/security-scan . --format markdown --min-severity medium

```

This command performs the following actions:

- Scans all agents, hooks, MCP servers, and configuration files in the current directory
- Filters out low-severity findings based on the `--min-severity` threshold
- Outputs a **security grade and score**, **counts by severity and confidence**, and **critical findings with exact file paths**
- Provides a **remediation order** with specific paths, reasons, and auto-fix safety indicators【/commands/security-scan.md#L60-L68】

For CI-friendly machine parsing, use JSON output:

```bash
/security-scan src/api --format json --min-severity high

```

## Automating Remediation with Safe Fixes

ECC supports deterministic automated patching for issues classified as safe to fix without human intervention.

To enable automated remediation, append the `--fix` flag:

```bash
/security-scan . --fix --format markdown

```

The execution flow follows these steps:

1. **Preview Mode**: The scanner first displays a "planned edits" preview showing exactly which files will be modified
2. **Selective Patching**: Applies only patches marked **safe-to-auto-fix** by AgentShield, avoiding potentially dangerous modifications
3. **Validation**: Automatically re-runs the scan after applying fixes to confirm the improved security score【/commands/security-scan.md#L54-L58】

## CI/CD Integration for Continuous Security

Integrating the security scanner into continuous integration ensures that no insecure code reaches the main branch. The ECC ecosystem provides a GitHub Action that wraps the AgentShield engine.

Create [`.github/workflows/security.yml`](https://github.com/affaan-m/ECC/blob/main/.github/workflows/security.yml) with the following configuration taken directly from the command documentation【/commands/security-scan.md#L70-L80】:

```yaml
name: Security Scan
on: [push, pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run ECC security scan
        uses: affaan-m/agentshield@v1
        with:
          path: "."
          min-severity: "medium"
          fail-on-findings: true

```

When configured with `fail-on-findings: true`, the workflow exits with an error code if any finding of `medium` severity or higher is detected, effectively blocking the merge until the issue is resolved.

## Summary

- **ECC provides native security scanning** through the `/security-scan` command defined in [`commands/security-scan.md`](https://github.com/affaan-m/ECC/blob/main/commands/security-scan.md), which wraps the AgentShield engine to analyze agent configurations, hooks, and MCP servers.
- **Local execution** supports multiple output formats (markdown, text, JSON) and severity filtering via `--min-severity` to focus on high-priority issues.
- **Automated remediation** is available through the `--fix` flag, which applies only patches marked as safe-to-auto-fix and validates improvements through re-scanning.
- **CI/CD integration** uses the `affaan-m/agentshield@v1` GitHub Action to enforce security gates, preventing merges when medium or high severity findings are detected.
- **The security-review skill** in [`skills/security-review/SKILL.md`](https://github.com/affaan-m/ECC/blob/main/skills/security-review/SKILL.md) provides the authoritative checklist that defines what constitutes a vulnerability in ECC workflows.

## Frequently Asked Questions

### What specific security issues does the ECC scanner detect?

The scanner validates against a comprehensive checklist defined in [`skills/security-review/SKILL.md`](https://github.com/affaan-m/ECC/blob/main/skills/security-review/SKILL.md), including hard-coded secrets in agent configurations, overly broad MCP permissions, unpinned `npx` executions that could lead to supply chain attacks, and improper hook implementations. The AgentShield engine specifically targets vulnerabilities unique to AI agent architectures, such as excessive file system access permissions and insecure secret handling patterns【/skills/security-review/SKILL.md】.

### Can I run the security scan on specific subdirectories rather than the entire repository?

Yes, the `/security-scan` command accepts a path argument that allows you to target specific directories. For example, `/security-scan src/api --format markdown` will scan only the `src/api` folder and its subdirectories. This is particularly useful for monorepos where you want to scan only the components modified in a specific commit or pull request【/commands/security-scan.md】.

### How does the automated remediation feature determine which fixes are safe to apply?

The `--fix` flag utilizes AgentShield's safety classification system, which marks specific remediation actions as **safe-to-auto-fix** based on deterministic patterns that cannot break functionality. Before applying any changes, the command displays a "planned edits" preview. Only patches that modify non-critical configuration values, remove detected secrets, or tighten permission scopes without changing API contracts are auto-applied. After execution, the system automatically re-runs the scan to verify the security grade improvement【/commands/security-scan.md#L54-L58】.

### Is the security scanning capability available for continuous integration pipelines outside of GitHub Actions?

While the raw analysis specifically documents the GitHub Action `affaan-m/agentshield@v1`, the underlying AgentShield engine is deterministic and command-line driven, making it adaptable to any CI/CD platform that supports containerized execution. The scanner outputs standardized formats (JSON and text) that can be consumed by Jenkins, GitLab CI, CircleCI, or other platforms. The `fail-on-findings` behavior can be replicated by checking the exit code or parsing the JSON output for severity counts in alternative CI environments【/commands/security-scan.md#L70-L80】.