Agentic Security Scanner

agentic-security

Skill by ara.so — Security Skills collection

agentic-security is a comprehensive security scanner built for AI-driven development workflows. It provides plain-English vulnerability findings with real-world cost estimates, auto-fix capabilities, and compliance framework attestations across 8 languages.

What It Does

• 12-pillar security scan: SAST, SCA, secrets, IaC, LLM safety, MCP agent-tool audit, auth/authZ, pipeline integrity, containers, deploy config, supply chain, and trend tracking
• Plain-English findings: No CVE jargon—shows stakes, estimated cost, and concrete fixes
• Auto-fix with preview: One-command remediation with backup and revert capabilities
• Compliance reports: NIST AI 600-1, OWASP ASVS, OWASP LLM Top 10, EU AI Act
• CISA KEV + EPSS prioritization: Focus on actively exploited vulnerabilities
• Function-level reachability: Know which dependency vulnerabilities actually affect your code
• Real-time bodyguard: Intercepts insecure AI-generated code before it hits disk

Installation

As Claude Code Plugin

/plugin marketplace add https://github.com/Clear-Capabilities/agentic-security
/plugin install agentic-security@clearcapabilities

Then restart Claude Code or run /reload-plugins.

As CLI Tool

npx @clear-capabilities/agentic-security-scanner secure .

Update Plugin

/plugin marketplace update clearcapabilities
/plugin install agentic-security@clearcapabilities

Core Commands

/agentic-security:secure

Router command that picks the best next action based on project state.

/agentic-security:secure
/agentic-security:secure --tour
/agentic-security:secure --help
/agentic-security:secure --daily

/agentic-security:scan

Run security scanner with various modes.

# Full scan
/agentic-security:scan

# Scan only changed files
/agentic-security:scan --mode diff

# Watch mode for continuous scanning
/agentic-security:scan --mode watch

# Set baseline for legacy projects
/agentic-security:scan --mode baseline

# Show only new findings since baseline
/agentic-security:scan --since-baseline

# Archaeology mode (deep historical scan)
/agentic-security:scan --mode archaeology

/agentic-security:triage

Investigate and validate findings.

# Show specific finding
/agentic-security:triage --mode show --id FINDING_ID

# Get detailed explanation
/agentic-security:triage --mode explain --id FINDING_ID

# Validate with PoC attempt
/agentic-security:triage --mode validate --id FINDING_ID

# Red-team simulation
/agentic-security:triage --mode red-team --id FINDING_ID

# Query findings
/agentic-security:triage --mode query "all SQL injection findings in api/"

/agentic-security:fix

Remediate vulnerabilities with auto-fix.

# Fix specific finding
/agentic-security:fix --id FINDING_ID

# Fix all critical issues
/agentic-security:fix --severity critical

# Fix all issues (with preview)
/agentic-security:fix --all

# Generate PR with fixes
/agentic-security:fix --mode pr --severity critical

# Rotate leaked secret
/agentic-security:fix --mode rotate-secret --id SECRET_FINDING_ID --auto

# Move secrets to vault
/agentic-security:fix --mode vault

# Harden configuration
/agentic-security:fix --mode harden

/agentic-security:find-and-fix-everything

One-shot scan and fix for all severities.

/agentic-security:find-and-fix-everything

Compliance & Reporting

Generate Compliance Report

# NIST AI 600-1 report
/agentic-security:compliance --report nist

# OWASP ASVS report
/agentic-security:compliance --report asvs

# OWASP LLM Top 10
/agentic-security:compliance --report llm

# EU AI Act
/agentic-security:compliance --report eu-ai-act

Interactive Compliance Walkthrough

/agentic-security:compliance --walkthrough nist-ai-600-1
/agentic-security:compliance --walkthrough owasp-asvs-5
/agentic-security:compliance --walkthrough eu-ai-act

Posture & Status

# Show security posture
/agentic-security:posture --mode status

# Generate report card
/agentic-security:posture --mode report-card

# Trend analysis
/agentic-security:posture --mode trend

# Threat landscape
/agentic-security:posture --mode threat

Supply Chain Security

# Check dependencies
/agentic-security:supply --mode check

# Generate SBOM
/agentic-security:supply --mode sbom

# CVE alerts for dependencies
/agentic-security:supply --mode cve-alerts

# License compliance
/agentic-security:supply --mode license

Setup & Integration

Install Git Hooks (Bodyguard Mode)

Intercepts insecure AI-generated code in real-time.

/agentic-security:setup --mode hooks

This blocks:

• SQL injection via concatenation
• Hardcoded API keys and secrets
• eval() on user input
• Command injection patterns
• Weak crypto usage

CI/CD Integration

/agentic-security:setup --mode ci

Enable Destructive Operation Guard

/agentic-security:setup --mode destructive-guard

Configuration

Create .agentic-security/config.json in your project root:

{
  "scan": {
    "exclude": [
      "node_modules/**",
      "dist/**",
      "*.test.js"
    ],
    "severity_threshold": "medium",
    "enable_flow_analysis": true,
    "enable_reachability": true
  },
  "fix": {
    "auto_backup": true,
    "preview_before_apply": true,
    "create_pr": false
  },
  "compliance": {
    "frameworks": ["nist", "asvs", "llm"],
    "custom_controls": ".agentic-security/compliance/custom/controls.json"
  },
  "bodyguard": {
    "enabled": true,
    "block_on_critical": true,
    "allow_override": false
  },
  "notifications": {
    "slack_webhook": "${SLACK_WEBHOOK_URL}",
    "notify_on": ["critical", "high"]
  }
}

Environment Variables

# Notifications
export SLACK_WEBHOOK_URL=https://hooks.slack.com/services/YOUR/WEBHOOK/URL

# Secret rotation (if using auto-rotate)
export STRIPE_API_KEY=sk_live_...
export AWS_ACCESS_KEY_ID=AKIA...
export AWS_SECRET_ACCESS_KEY=...

# GitHub integration (for PR creation)
export GITHUB_TOKEN=ghp_...

Real-World Usage Examples

Example 1: Initial Project Scan

// Run first-time scan on existing project
/agentic-security:scan --mode baseline

// Review critical findings
/agentic-security:triage --mode show --severity critical

// Fix critical SQL injection
/agentic-security:fix --id sql-injection-users-ts-42

Example 2: Fixing Hardcoded Secrets

When scanner finds:

[critical] Hardcoded Stripe live key    src/lib/billing.ts:7
  Could enable fraudulent charges against your account.
  Estimated cost if exploited: $50k–$500k
  Fix: rotate via /agentic-security:fix --rotate-secret --auto

Before:

// src/lib/billing.ts
const stripe = new Stripe('sk_live_51HxABC...', {
  apiVersion: '2023-10-16',
});

Run fix:

/agentic-security:fix --mode rotate-secret --id stripe-key-billing-7 --auto

After:

// src/lib/billing.ts
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY, {
  apiVersion: '2023-10-16',
});

The command also:

1. Rotates the key via Stripe API
2. Adds new key to .env.example as placeholder
3. Updates CI/CD secrets if configured

Example 3: SQL Injection Fix

When scanner finds:

[critical] SQL Injection    api/users.ts:42
  Could leak PII for ~5,000 users.
  Estimated cost if exploited: $125k–$1.3M
  Fix: use parameterized query

Before:

// api/users.ts
export async function getUser(req: Request, res: Response) {
  const userId = req.query.id;
  const query = `SELECT * FROM users WHERE id = ${userId}`;
  const result = await db.query(query);
  res.json(result.rows[0]);
}

Run fix:

/agentic-security:fix --id sql-injection-users-ts-42

After:

// api/users.ts
export async function getUser(req: Request, res: Response) {
  const userId = req.query.id;