agentic-security-scanner — Claude Code skill
A skill that scans your code for vulnerabilities, explains findings in plain English and fixes them. Useful when AI writes code faster than you can review it.
npx skills add reason-machines/security-skills --skill agentic-security-scanner -a claude-codeWhat agentic-security-scanner does
The scan covers static analysis, dependencies, hardcoded secrets, infrastructure config, LLM safety and an audit of the agent's MCP tools. Findings come with a cost estimate and a concrete fix instead of CVE jargon. Modes include diff-only, watch and a deep pass over old code.
Fixes run with a preview, a backup and a revert option. One mode opens a pull request, another moves leaked secrets into a vault. Creating a PR needs GITHUB_TOKEN; Slack alerts need SLACK_WEBHOOK_URL. Settings live in .agentic-security/config.json.
Bodyguard mode installs as a git hook and catches unsafe AI output before it reaches disk: SQL string concatenation, embedded API keys, eval() on user input, weak crypto. The hook blocks the commit, so on a legacy codebase set a baseline first — otherwise the stream of findings will stall your work.
What it helps with
- catch SQL injection and hardcoded keys before release
- check dependencies for known CVEs and generate an SBOM
- remediate critical findings in one command with a rollback
- map the project against NIST AI 600-1 or OWASP ASVS
- block unsafe AI-generated code before it gets committed
Example prompts for the agent
- Scan this project for vulnerabilities and show only critical findings
- Fix all critical issues and open a pull request with the changes
- Install git hooks so unsafe code is blocked before commit
How to install agentic-security-scanner
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill agentic-security-scanner -a claude-code2Manually: put the files in place
~/.claude/skills/agentic-security-scanner/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/agentic-security-scanner/
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill agentic-security-scanner -a codex2Manually: put the files in place
.agents/skills/agentic-security-scanner/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill agentic-security-scanner -a cursor2Manually: put the files in place
.cursor/skills/agentic-security-scanner/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install reason-machines/security-skills agentic-security-scanner2Manually: put the files in place
.github/skills/agentic-security-scanner/SKILL.md1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill agentic-security-scanner -a gemini-cli2Platform CLI
gemini skills install https://github.com/reason-machines/security-skills --path skills/agentic-security-scannerManually: put the files in place
.devin/skills/agentic-security-scanner/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill agentic-security-scanner -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about agentic-security-scanner
How do I install agentic-security-scanner in Claude Code?
Run npx skills add reason-machines/security-skills --skill agentic-security-scanner -a claude-code. The skill lands in ~/.claude/skills/agentic-security-scanner/SKILL.md.
What does agentic-security-scanner do?
It scans code across several security areas, explains each finding in plain language with a cost estimate, and can fix issues with a preview and backup.
What does the skill need to work?
PR creation requires GITHUB_TOKEN and Slack alerts require SLACK_WEBHOOK_URL. Configuration goes in .agentic-security/config.json.
