Agentic Security Scanner

agentic-security

Skill by ara.so — Security Skills collection

agentic-security is a comprehensive security scanner built for AI-driven development workflows. It provides plain-English vulnerability findings with real-world cost estimates, auto-fix capabilities, and compliance framework attestations across 8 languages.

What It Does

• 12-pillar security scan: SAST, SCA, secrets, IaC, LLM safety, MCP agent-tool audit, auth/authZ, pipeline integrity, containers, deploy config, supply chain, and trend tracking
• Plain-English findings: No CVE jargon—shows stakes, estimated cost, and concrete fixes
• Auto-fix with preview: One-command remediation with backup and revert capabilities
• Compliance reports: NIST AI 600-1, OWASP ASVS, OWASP LLM Top 10, EU AI Act
• CISA KEV + EPSS prioritization: Focus on actively exploited vulnerabilities
• Function-level reachability: Know which dependency vulnerabilities actually affect your code
• Real-time bodyguard: Intercepts insecure AI-generated code before it hits disk

Installation

As Claude Code Plugin

/plugin marketplace add https://github.com/Clear-Capabilities/agentic-security
/plugin install agentic-security@clearcapabilities

Then restart Claude Code or run /reload-plugins.

As CLI Tool

npx @clear-capabilities/agentic-security-scanner secure .

Update Plugin

/plugin marketplace update clearcapabilities
/plugin install agentic-security@clearcapabilities

Core Commands

/agentic-security:secure

Router command that picks the best next action based on project state.

/agentic-security:secure
/agentic-security:secure --tour
/agentic-security:secure --help
/agentic-security:secure --daily

/agentic-security:scan

Run security scanner with various modes.

# Full scan
/agentic-security:scan

# Scan only changed files
/agentic-security:scan --mode diff

# Watch mode for continuous scanning
/agentic-security:scan --mode watch

# Set baseline for legacy projects
/agentic-security:scan --mode baseline

# Show only new findings since baseline
/agentic-security:scan --since-baseline

# Archaeology mode (deep historical scan)
/agentic-security:scan --mode archaeology

/agentic-security:triage

Investigate and validate findings.

# Show specific finding
/agentic-security:triage --mode show --id FINDING_ID

# Get detailed explanation
/agentic-security:triage --mode explain --id FINDING_ID

# Validate with PoC attempt
/agentic-security:triage --mode validate --id FINDING_ID

# Red-team simulation
/agentic-security:triage --mode red-team --id FINDING_ID

# Query findings
/agentic-security:triage --mode query "all SQL injection findings in api/"

/agentic-security:fix

Remediate vulnerabilities with auto-fix.

# Fix specific finding
/agentic-security:fix --id FINDING_ID

# Fix all critical issues
/agentic-security:fix --severity critical

# Fix all issues (with preview)
/agentic-security:fix --all

# Generate PR with fixes
/agentic-security:fix --mode pr --severity critical

# Rotate leaked secret
/agentic-security:fix --mode rotate-secret --id SECRET_FINDING_ID --auto

# Move secrets to vault
/agentic-security:fix --mode vault

# Harden configuration
/agentic-security:fix --mode harden

/agentic-security:find-and-fix-everything

One-shot scan and fix for all severities.

/agentic-security:find-and-fix-everything

Compliance & Reporting

Generate Compliance Report

# NIST AI 600-1 report
/agentic-security:compliance --report nist

# OWASP ASVS report
/agentic-security:compliance --report asvs

# OWASP LLM Top 10
/agentic-security:compliance --report llm

# EU AI Act
/agentic-security:compliance --report eu-ai-act

Interactive Compliance Walkthrough

/agentic-security:compliance --walkthrough nist-ai-600-1
/agentic-security:compliance --walkthrough owasp-asvs-5
/agentic-security:compliance --walkthrough eu-ai-act

Posture & Status

# Show security posture
/agentic-security:posture --mode status

# Generate report card
/agentic-security:posture --mode report-card

# Trend analysis
/agentic-security:posture --mode trend

# Threat landscape
/agentic-security:posture --mode threat

Supply Chain Security

# Check dependencies
/agentic-security:supply --mode check

# Generate SBOM
/agentic-security:supply --mode sbom

# CVE alerts for dependencies
/agentic-security:supply --mode cve-alerts

# License compliance
/agentic-security:supply --mode license

Setup & Integration

Install Git Hooks (Bodyguard Mode)

Intercepts insecure AI-generated code in real-time.

/agentic-security:setup --mode hooks

This blocks:

• SQL injection via concatenation
• Hardcoded API keys and secrets
• eval() on user input
• Command injection patterns
• Weak crypto usage

CI/CD Integration

/agentic-security:setup --mode ci

Enable Destructive Operation Guard

/agentic-security:setup --mode destructive-guard

Configuration

Create .agentic-security/config.json in your project root:

{
  "scan": {
    "exclude": [
      "node_modules/**",
      "dist/**",
      "*.test.js"
    ],
    "severity_threshold": "medium",
    "enable_flow_analysis": true,
    "enable_reachability": true
  },
  "fix": {
    "auto_backup": true,
    "preview_before_apply": true,
    "create_pr": false
  },
  "compliance": {
    "frameworks": ["nist", "asvs", "llm"],
    "custom_controls": ".agentic-security/compliance/custom/controls.json"
  },
  "bodyguard": {
    "enabled": true,
    "block_on_critical": true,
    "allow_override": false
  },
  "notifications": {
    "slack_webhook": "${SLACK_WEBHOOK_URL}",
    "notify_on": ["critical", "high"]
  }
}

Environment Variables

# Notifications
export SLACK_WEBHOOK_URL=https://hooks.slack.com/services/YOUR/WEBHOOK/URL

# Secret rotation (if using auto-rotate)
export STRIPE_API_KEY=sk_live_...
export AWS_ACCESS_KEY_ID=AKIA...
export AWS_SECRET_ACCESS_KEY=...

# GitHub integration (for PR creation)
export GITHUB_TOKEN=ghp_...

Real-World Usage Examples

Example 1: Initial Project Scan

// Run first-time scan on existing project
/agentic-security:scan --mode baseline

// Review critical findings
/agentic-security:triage --mode show --severity critical

// Fix critical SQL injection
/agentic-security:fix --id sql-injection-users-ts-42

Example 2: Fixing Hardcoded Secrets

When scanner finds:

[critical] Hardcoded Stripe live key    src/lib/billing.ts:7
  Could enable fraudulent charges against your account.
  Estimated cost if exploited: $50k–$500k
  Fix: rotate via /agentic-security:fix --rotate-secret --auto

Before:

// src/lib/billing.ts
const stripe = new Stripe('sk_live_51HxABC...', {
  apiVersion: '2023-10-16',
});

Run fix:

/agentic-security:fix --mode rotate-secret --id stripe-key-billing-7 --auto

After:

// src/lib/billing.ts
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY, {
  apiVersion: '2023-10-16',
});

The command also:

1. Rotates the key via Stripe API
2. Adds new key to .env.example as placeholder
3. Updates CI/CD secrets if configured

Example 3: SQL Injection Fix

When scanner finds:

[critical] SQL Injection    api/users.ts:42
  Could leak PII for ~5,000 users.
  Estimated cost if exploited: $125k–$1.3M
  Fix: use parameterized query

Before:

// api/users.ts
export async function getUser(req: Request, res: Response) {
  const userId = req.query.id;
  const query = `SELECT * FROM users WHERE id = ${userId}`;
  const result = await db.query(query);
  res.json(result.rows[0]);
}

Run fix:

/agentic-security:fix --id sql-injection-users-ts-42

After:

// api/users.ts
export async function getUser(req: Request, res: Response) {
  const userId = req.query.id;
  const query = 'SELECT * FROM users WHERE id = ?';
  const result = await db.query(query, [userId]);
  res.json(result.rows[0]);
}

Example 4: Webhook Signature Validation

Before:

// api/stripe-webhook.ts
export async function handleWebhook(req: Request, res: Response) {
  const event = req.body;
  
  if (event.type === 'payment_intent.succeeded') {
    await unlockPaidFeatures(event.data.object.customer);
  }
  
  res.json({ received: true });
}

Run fix:

/agentic-security:fix --id webhook-signature-missing-12

After:

// api/stripe-webhook.ts
export async function handleWebhook(req: Request, res: Response) {
  const sig = req.headers['stripe-signature'];
  const endpointSecret = process.env.STRIPE_WEBHOOK_SECRET;
  
  let event;
  try {
    event = stripe.webhooks.constructEvent(
      req.rawBody,
      sig,
      endpointSecret
    );
  } catch (err) {
    return res.status(400).send(`Webhook Error: ${err.message}`);
  }
  
  if (event.type === 'payment_intent.succeeded') {
    await unlockPaidFeatures(event.data.object.customer);
  }
  
  res.json({ received: true });
}

Example 5: Pre-Deployment Check in CI

# .github/workflows/security.yml
name: Security Scan

on: [push, pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Run agentic-security scan
        run: |
          npx @clear-capabilities/agentic-security-scanner scan --mode diff --since-baseline
          
      - name: Block on critical findings
        run: |
          npx @clear-capabilities/agentic-security-scanner posture --mode status --fail-on critical

Example 6: Daily Security Review

#!/bin/bash
# daily-security-check.sh

# Run daily scan
npx @clear-capabilities/agentic-security-scanner secure --daily

# Generate report card
npx @clear-capabilities/agentic-security-scanner posture --mode report-card > /tmp/security-report.txt

# Send to Slack
curl -X POST $SLACK_WEBHOOK_URL \
  -H 'Content-Type: application/json' \
  -d "{\"text\": \"$(cat /tmp/security-report.txt)\"}"

Example 7: Dependency Vulnerability Check

# Check all dependencies for CVEs
/agentic-security:supply --mode check

# Show only function-reachable vulnerabilities
/agentic-security:supply --mode check --reachability function-reachable

# Generate SBOM for compliance
/agentic-security:supply --mode sbom --format spdx

Common Patterns

Pattern 1: Legacy Codebase Onboarding

# Step 1: Set baseline (don't fail on existing issues)
/agentic-security:scan --mode baseline

# Step 2: Review critical count
/agentic-security:posture --mode status

# Step 3: Fix only new critical issues going forward
/agentic-security:scan --since-baseline --severity critical

# Step 4: Gradually reduce baseline
/agentic-security:fix --severity critical --all
/agentic-security:scan --mode baseline --update

Pattern 2: Pre-Commit Review

# Scan only staged changes
/agentic-security:scan --mode diff --staged

# Auto-fix safe issues
/agentic-security:fix --auto-safe

# Block commit if critical found
/agentic-security:posture --mode status --fail-on critical

Pattern 3: Compliance Audit Prep

# Generate all compliance reports
/agentic-security:compliance --report nist
/agentic-security:compliance --report asvs
/agentic-security:compliance --report llm

# Create attestation package
/agentic-security:compliance --mode attestation --output ./audit/

# Generate evidence walkthrough
/agentic-security:compliance --walkthrough nist-ai-600-1 --output ./audit/nist-walkthrough.md

Troubleshooting

High False Positive Rate

# Enable flow analysis for better precision
/agentic-security:scan --enable-flow-analysis

# Use validation mode to confirm findings
/agentic-security:triage --mode validate --id FINDING_ID

# Suppress specific false positives
# Add to .agentic-security/suppressions.json:
{
  "suppressions": [
    {
      "id": "sql-injection-safe-query-42",
      "reason": "Uses ORM with parameterization",
      "expires": "2026-12-31"
    }
  ]
}

Scanner Missing Vulnerabilities

# Enable archaeology mode for deep scan
/agentic-security:scan --mode archaeology

# Run AI-assisted rescan
/agentic-security:labs --mode model-rescan --severity critical

# Submit custom detection rule
/agentic-security:labs --mode synthesize-rule --pattern "your custom pattern"

Fix Applied Incorrectly

# Revert last fix
/agentic-security:fix --revert --id FINDING_ID

# All fixes create backups in .agentic-security/backups/
# Manually restore:
cp .agentic-security/backups/src/lib/billing.ts.backup src/lib/billing.ts

Performance Issues on Large Repos

# Exclude build artifacts
# In .agentic-security/config.json:
{
  "scan": {
    "exclude": [
      "node_modules/**",
      "dist/**",
      "build/**",
      ".next/**",
      "*.min.js"
    ]
  }
}

# Scan only changed files
/agentic-security:scan --mode diff

# Disable reachability analysis for faster scans
/agentic-security:scan --disable-reachability

Bodyguard Blocking Valid Code

# Disable bodyguard temporarily
/agentic-security:setup --mode bodyguard --disable

# Or allow override in config:
{
  "bodyguard": {
    "enabled": true,
    "allow_override": true
  }
}

# Then override specific block:
git commit --no-verify

Language-Specific Examples

JavaScript/TypeScript

// Insecure: Command injection
import { exec } from 'child_process';
exec(`git clone ${userInput}`); // ❌ Detected

// Secure: Sanitized input
import { exec } from 'child_process';
import { execFile } from 'child_process';
execFile('git', ['clone', userInput]); // ✅ Safe

Python

# Insecure: SQL injection
cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")  # ❌ Detected

# Secure: Parameterized query
cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))  # ✅ Safe

Java

// Insecure: LDAP injection
String filter = "(uid=" + username + ")";
ctx.search("ou=users", filter, controls);  // ❌ Detected

// Secure: Escaped input
String filter = "(uid=" + escapeForLDAP(username) + ")";
ctx.search("ou=users", filter, controls);  // ✅ Safe

Advanced Features

Custom Compliance Controls

// .agentic-security/compliance/custom/controls.json
{
  "framework": "internal-security-policy",
  "version": "2.1",
  "controls": [
    {
      "id": "ISP-001",
      "title": "All API endpoints require authentication",
      "check": "auth-required-on-routes",
      "severity": "critical"
    }
  ]
}

Then run:

/agentic-security:compliance --report custom --framework internal-security-policy

Cross-Repository Analysis

# Scan multiple repos for shared vulnerabilities
/agentic-security:labs --mode cross-repo --repos org/repo1,org/repo2,org/repo3

Risk Dollar Estimation

# Show findings with cost-benefit analysis
/agentic-security:labs --mode risk-dollars --severity high

Integration with Other Tools

SARIF Export (for GitHub Code Scanning)

npx @clear-capabilities/agentic-security-scanner scan --output sarif > results.sarif

# Upload to GitHub
gh api /repos/OWNER/REPO/code-scanning/sarifs \
  -F sarif=@results.sarif \
  -F commit_sha=$GITHUB_SHA \
  -F ref=$GITHUB_REF

DefectDojo Integration

# Generate SARIF with codeFlows
npx @clear-capabilities/agentic-security-scanner scan \
  --output sarif \
  --enable-code-flows > agentic-security.sarif

# Import to DefectDojo API
curl -X POST https://defectdojo.example.com/api/v2/import-scan/ \
  -H "Authorization: Token ${DEFECTDOJO_TOKEN}" \
  -F "scan_type=SARIF" \
  -F "file=@agentic-security.sarif" \
  -F "engagement=1"

License: PolyForm Internal Use (use to secure your own code, not for resale)

Support: Open GitHub issue at Clear-Capabilities/agentic-security