agentsclimarketplace
Sign in

Security radar

Skill search-atlas-group/amm-founding-circle/skills/security-radar

Audit your own agentic setup's security posture. Use when the user asks to check/harden their setup, run a security check on their machine, scan their installed Claude Code skills / MCP servers / project dependencies, or wants a posture brief. Cross-references the installed surface against OSV.dev + npm audit and the OWASP LLM/Web Top 10. Read-only.From its SKILL.md

Install
npx -y skills add search-atlas-group/amm-founding-circle --skill security-radar

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.7 KB, 555 tokens by cl100k_base, as published. Nobody here has run it

security-radar

Continuous-monitoring counterpart to /security-scan. Where /security-scan vets a repo before you install it, security-radar watches the surface you already run — installed Claude Code skills, configured MCP servers, project dependencies, and permission configs — and cross-references them against live advisory feeds and the OWASP frameworks. It produces a plain-English posture brief.

It is read-only: it inspects config files and lockfiles and changes nothing.

When to use

  • "Run a security check on my setup" / "harden my setup" / "am I exposed?"
  • After installing new skills, MCP servers, or dependencies.
  • As a weekly habit (the threat surface changes even when your code doesn't — vetted packages get compromised later).

How to run

From the kit folder (or wherever you placed the script):

python3 security-radar.py            # audit deps in the current project + your global surface
python3 security-radar.py --path /path/to/a/client/project
python3 security-radar.py --json     # machine-readable output

No installs needed — it uses the Python standard library only. If a tool (npm) or the network (OSV.dev) is unavailable, that check is skipped and noted; the rest still runs.

What it checks

  1. Installed skills (~/.claude/skills, ~/.claude/plugins) — static-scans each for risky shapes (remote-pipe-to-shell, eval of fetched code, hardcoded credentials). → OWASP LLM05 Supply Chain
  2. MCP servers (~/.claude.json, Claude Desktop config) — flags 3rd-party / remote servers not on the trusted-vendor list that may mediate your auth tokens. → LLM07 Insecure Plugin Design
  3. Permissions (~/.claude/settings.json) — flags bypassPermissions and unconstrained allow rules. → LLM08 Excessive Agency / A01 Broken Access Control
  4. Dependencies (package.json / requirements.txt) — npm audit + OSV.dev cross-check for known-vulnerable versions. → LLM05 / A06 Vulnerable Components

How to present results

Run the script, then summarize the posture brief for the user: lead with the overall rating (CLEAN / CARE / QUARANTINE / REJECT), then walk the highest-severity findings first with the concrete fix for each. The full brief is also saved to ~/security-radar-report-<date>.md. Encourage a weekly cadence and designating one owner per team.

What ships with it: 2 files

16.5 KB alongside SKILL.md, 1 of them executable

Keep looking

Skills are one crate of 326,851. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.