mirror of
https://github.com/affaan-m/ECC.git
synced 2026-08-21 06:52:24 +02:00
Gaurav Dubey
9d1ecb0754
The `.opencode/commands/*.md` frontmatter referenced agents with the Claude Code plugin namespace (`agent: everything-claude-code:<name>`), but ECC's opencode integration registers its agents unscoped in `opencode.json`'s `agent` map (`code-reviewer`, `planner`, ...), and that file's own `command` section already references them unscoped. The `everything-claude-code:` scope resolves under no opencode config (the opencode plugin package is `ecc-universal`, and inline-config agents are bare), so subtask commands like `/code-review` hard-fail with `Agent not found: everything-claude-code:code-reviewer`. Non-subtask commands fall back to the default agent and appear to work — which is why only some commands failed. Strip the `everything-claude-code:` prefix from all 30 command frontmatter agent ids so they match the registered agents, fix the MIGRATION.md example, and replace the test that enforced the broken scoped invariant with one that asserts each command agent id is a registered opencode agent (fails on the old scoped ids, passes on the fix). Fixes #2477
93 lines
2.6 KiB
Markdown
93 lines
2.6 KiB
Markdown
---
|
|
description: Run AgentShield against agent, hook, MCP, permission, and secret surfaces.
|
|
agent: security-reviewer
|
|
subtask: true
|
|
---
|
|
|
|
# Security Scan Command
|
|
|
|
Run AgentShield against the current project or a target path, then turn the findings into a prioritized remediation plan.
|
|
|
|
## Usage
|
|
|
|
`/security-scan [path] [--format text|json|markdown|html] [--min-severity low|medium|high|critical] [--fix]`
|
|
|
|
- `path` (optional): defaults to the current project. Use a `.claude/` path, a repo root, or a checked-in template directory.
|
|
- `--format`: output format. Use `json` for CI, `markdown` for handoffs, and `html` for standalone review reports.
|
|
- `--min-severity`: filters lower-priority findings.
|
|
- `--fix`: applies only AgentShield fixes explicitly marked as safe and auto-fixable.
|
|
|
|
## Deterministic Engine
|
|
|
|
Prefer the packaged scanner:
|
|
|
|
```bash
|
|
npx ecc-agentshield scan --path "${TARGET_PATH:-.}" --format text
|
|
```
|
|
|
|
For local AgentShield development, run from the AgentShield checkout:
|
|
|
|
```bash
|
|
npm run scan -- --path "${TARGET_PATH:-.}" --format text
|
|
```
|
|
|
|
Do not invent findings. Use AgentShield output as the source of truth and separate scanner facts from follow-up judgment.
|
|
|
|
## Review Checklist
|
|
|
|
1. Identify active runtime findings first:
|
|
- hardcoded secrets
|
|
- broad permissions
|
|
- executable hooks
|
|
- MCP servers with shell, filesystem, remote transport, or unpinned `npx`
|
|
- agent prompts that handle untrusted content without defenses
|
|
2. Separate lower-confidence inventory:
|
|
- docs examples
|
|
- template examples
|
|
- plugin manifests
|
|
- project-local optional settings
|
|
3. For each critical or high finding, return:
|
|
- file path
|
|
- severity
|
|
- runtime confidence
|
|
- why it matters
|
|
- exact remediation
|
|
- whether it is safe to auto-fix
|
|
4. If `--fix` is requested, state the planned edits before applying fixes.
|
|
5. Re-run the scan after fixes and report the before/after score.
|
|
|
|
## Output Contract
|
|
|
|
Return:
|
|
|
|
1. Security grade and score.
|
|
2. Counts by severity and runtime confidence.
|
|
3. Critical/high findings with exact paths.
|
|
4. Lower-confidence findings grouped separately.
|
|
5. A remediation order.
|
|
6. Commands run and whether the scan was local, CI, or npx-backed.
|
|
|
|
## CI Pattern
|
|
|
|
Use AgentShield in GitHub Actions for enforced gates:
|
|
|
|
```yaml
|
|
- uses: affaan-m/agentshield@v1
|
|
with:
|
|
path: "."
|
|
min-severity: "medium"
|
|
fail-on-findings: true
|
|
```
|
|
|
|
## Links
|
|
|
|
- Skill: `skills/security-scan/SKILL.md`
|
|
- Agent: `agents/security-reviewer.md`
|
|
- Scanner: <https://github.com/affaan-m/agentshield>
|
|
|
|
## Arguments
|
|
|
|
$ARGUMENTS:
|
|
- optional target path
|
|
- optional AgentShield flags
|