ai-coding-shield/ai-coding-shield

AI Coding Shield Skill

This skill allows you to use ai-coding-shield to audit your AI development artifacts for security risks. It helps identify potential threats in workflows, MCP configurations, skills, and other agentic components.

When to use

Use this skill when you need to:

• Audit Workflows: Check .github/workflows or other CI/CD scripts for security vulnerabilities.
• Verify MCPs: Validate Model Context Protocol servers against trusted authors and domains.
• Scan Skills: Review other agentic skills for dangerous patterns (e.g., command injection, data exfiltration).
• Check Threats: Scan for general security threats like obfuscated code, suspicious package installations, or network risks.

How to use

First, ensure the tool is installed by running the installation script provided in this skill:

./skill/scripts/install.sh

Once installed, you can use the ai-coding-shield CLI to perform various security tasks.

Scan a directory

To audit the current directory or a specific path (e.g., .agent/):

ai-coding-shield audit .

Or for a specific folder:

ai-coding-shield audit .agent/

List known threats

To see the catalog of threats that the tool can detect:

ai-coding-shield list

Get info on a specific threat

To understand a specific threat ID returned in a report:

ai-coding-shield info CMD_001

CI/CD Integration (Optional)

You can integrate ai-coding-shield into your GitHub Actions pipeline to automatically scan for risks on every push.

[!IMPORTANT] User Confirmation Required: Before adding this to a pipeline, you must explicitly confirm with the user that they want to enable automated security scanning in their CI/CD process.

If approved, you can add a step like this to your workflow file (e.g., .github/workflows/security.yml):

- name: AI Coding Shield Audit
  uses: AI-Coding-Shield/ai-coding-shield@v1
  with:
    path: .
    fail-on: high