OpenParable
Skip to content
← Back to skills

Security Scanning

DevOps & Security
security-scanning

Security Scanning is an Agent Skill for devops & security published in the a5c-ai/babysitter repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

AgentShield security audit with 5 scanning categories, 102 static analysis rules, and optional red-team simulation.

View on GitHub ↗
QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

  1. Open your project in Codex.
  2. Copy and paste the prompt below.
  3. Review files and risks before approving any action.
Prompt to paste
Inspect the Agent Skill at https://github.com/a5c-ai/babysitter/blob/HEAD/library/methodologies/everything-claude-code/skills/security-scanning/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/security-scanning, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

  • AWS access keys (AKIA pattern)
  • GitHub tokens (ghp_, gho_, ghs_, ghr_)
  • Generic API keys and bearer tokens
  • Database connection strings with credentials
  • Private keys (RSA, EC, SSH)
  • JWT secrets and signing keys
  • OAuth client secrets
  • Slack tokens and webhooks
  • Cloud provider credentials (GCP, Azure)

2. Permission Auditing

  • File system read/write scope
  • Network calls and protocols
  • Process execution (child_process)
  • File permissions (777, world-writable)
  • CORS and CSP headers
  • Docker privilege escalation

3. Hook Injection Analysis

  • Git hooks for command injection
  • npm lifecycle scripts (preinstall, postinstall)
  • Claude Code hooks for unsafe patterns
  • eval()/Function()/dynamic code execution
  • Unvalidated user input in shell commands

4. MCP Risk Profiling

  • Tool permission inventory
  • Data exposure risk mapping
  • Transport security (stdio vs SSE vs HTTP)
  • Prompt injection via tool descriptions
  • Rate limiting verification

5. Agent Config Review

  • Model settings integrity
  • Prompt injection resistance
  • Tool allowlist scoping
  • Output validation and sanitization
  • Information leakage in error messages

Optional: Red Team Simulation

  • Attack simulation against found vulnerabilities
  • Exploitability rating: trivial, moderate, difficult, theoretical
  • Blue-team defense recommendations

When to Use

  • Pre-deployment security review
  • New dependency introduction
  • Hook or plugin configuration changes
  • Agent or MCP server setup

Agents Used

  • security-reviewer (primary consumer)