WEBDIENSTE/ECC

Fork 0

mirror of https://github.com/affaan-m/ECC.git synced 2026-08-17 21:15:40 +02:00

Files

T

6fac227f7a fix(plan-orchestrate): detect ecc@ecc marketplace + emit ecc: agent prefix (#2316 ) (#2409 )

* fix(plan-orchestrate): detect ecc@ecc marketplace + emit ecc: agent prefix (#2316)

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix(ci): resync lockfiles with package.json (eslint 10) + migrate yarn.lock to Yarn 4 format

package.json requires eslint@^10.6.0 but the committed locks pinned 9.39.2, so
npm ci aborted and Yarn 4 hardened mode rejected the stale v1-classic yarn.lock
(YN0028). Regenerate package-lock.json and rewrite yarn.lock in Yarn 4 (berry)
format so npm ci and immutable yarn installs both pass.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix(ci): require clean probe exit for Windows shell/bash detection; add pyyaml dev dep

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

---------

Co-authored-by: affaan <affaan@itomarkets.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

2026-07-03 20:00:51 -07:00

2.6 KiB

Raw Blame History

description, agent, subtask

description	agent	subtask
Run AgentShield against agent, hook, MCP, permission, and secret surfaces.	ecc:security-reviewer	true

Security Scan Command

Run AgentShield against the current project or a target path, then turn the findings into a prioritized remediation plan.

Usage

path (optional): defaults to the current project. Use a .claude/ path, a repo root, or a checked-in template directory.
--format: output format. Use json for CI, markdown for handoffs, and html for standalone review reports.
--min-severity: filters lower-priority findings.
--fix: applies only AgentShield fixes explicitly marked as safe and auto-fixable.

Deterministic Engine

Prefer the packaged scanner:

npx ecc-agentshield scan --path "${TARGET_PATH:-.}" --format text

For local AgentShield development, run from the AgentShield checkout:

npm run scan -- --path "${TARGET_PATH:-.}" --format text

Do not invent findings. Use AgentShield output as the source of truth and separate scanner facts from follow-up judgment.

Review Checklist

Identify active runtime findings first:
- hardcoded secrets
- broad permissions
- executable hooks
- MCP servers with shell, filesystem, remote transport, or unpinned npx
- agent prompts that handle untrusted content without defenses
Separate lower-confidence inventory:
- docs examples
- template examples
- plugin manifests
- project-local optional settings
For each critical or high finding, return:
- file path
- severity
- runtime confidence
- why it matters
- exact remediation
- whether it is safe to auto-fix
If --fix is requested, state the planned edits before applying fixes.
Re-run the scan after fixes and report the before/after score.

Output Contract

Return:

Security grade and score.
Counts by severity and runtime confidence.
Critical/high findings with exact paths.
Lower-confidence findings grouped separately.
A remediation order.
Commands run and whether the scan was local, CI, or npx-backed.

CI Pattern

Use AgentShield in GitHub Actions for enforced gates:

- uses: affaan-m/agentshield@v1
  with:
    path: "."
    min-severity: "medium"
    fail-on-findings: true

Arguments

$ARGUMENTS:

optional target path
optional AgentShield flags

2.6 KiB Raw Blame History