# Security Radar

> Audit your own agentic setup's security posture. Use when the user asks to check/harden their setup, run a security check on their machine, scan their installed Claude Code skills / MCP servers / project dependencies, or wants a posture brief. Cross-references the installed surface against OSV.dev + npm audit and the OWASP LLM/Web Top 10. Read-only.

- Skill: `search-atlas-group/security-radar` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add search-atlas-group/security-radar`
- Raw SKILL.md: https://api.skillmd.com/api/skills/search-atlas-group/security-radar/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: search-atlas-group (https://skillmd.com/u/search-atlas-group)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/search-atlas-group/security-radar

---


# security-radar

Continuous-monitoring counterpart to `/security-scan`. Where `/security-scan` vets a repo **before** you install it, `security-radar` watches the surface you **already** run — installed Claude Code skills, configured MCP servers, project dependencies, and permission configs — and cross-references them against live advisory feeds and the OWASP frameworks. It produces a plain-English posture brief.

It is **read-only**: it inspects config files and lockfiles and changes nothing.

## When to use
- "Run a security check on my setup" / "harden my setup" / "am I exposed?"
- After installing new skills, MCP servers, or dependencies.
- As a weekly habit (the threat surface changes even when your code doesn't — vetted packages get compromised later).

## How to run
From the kit folder (or wherever you placed the script):

```
python3 security-radar.py            # audit deps in the current project + your global surface
python3 security-radar.py --path /path/to/a/client/project
python3 security-radar.py --json     # machine-readable output
```

No installs needed — it uses the Python standard library only. If a tool (`npm`) or the network (OSV.dev) is unavailable, that check is skipped and noted; the rest still runs.

## What it checks
1. **Installed skills** (`~/.claude/skills`, `~/.claude/plugins`) — static-scans each for risky shapes (remote-pipe-to-shell, eval of fetched code, hardcoded credentials). → OWASP LLM05 Supply Chain
2. **MCP servers** (`~/.claude.json`, Claude Desktop config) — flags 3rd-party / remote servers not on the trusted-vendor list that may mediate your auth tokens. → LLM07 Insecure Plugin Design
3. **Permissions** (`~/.claude/settings.json`) — flags `bypassPermissions` and unconstrained allow rules. → LLM08 Excessive Agency / A01 Broken Access Control
4. **Dependencies** (`package.json` / `requirements.txt`) — `npm audit` + OSV.dev cross-check for known-vulnerable versions. → LLM05 / A06 Vulnerable Components

## How to present results
Run the script, then summarize the posture brief for the user: lead with the overall rating (CLEAN / CARE / QUARANTINE / REJECT), then walk the highest-severity findings first with the concrete fix for each. The full brief is also saved to `~/security-radar-report-<date>.md`. Encourage a weekly cadence and designating one owner per team.