jiten-singh-shahi/security-scan

External tool: AgentShield is published as ecc-agentshield on npm by affaan-m. It is a third-party security scanner, not part of SCC itself. Maintenance risk: This package has no SLA or maintenance guarantee. If it becomes unavailable, use the manual scanning section below as a fallback.

Security Scan Skill

Audit your Claude Code configuration for security issues using AgentShield.

When to Use

• Before submitting an AppExchange managed package for security review
• When running a pre-deployment security gate in CI/CD pipelines
• When auditing a new codebase for SOQL injection, XSS, or FLS violations
• When a PMD or Checkmarx scan surfaces violations that need triaging
• When validating that new Apex contributors follow secure coding patterns

What It Scans

| File | Checks | |------|--------| | CLAUDE.md | Hardcoded secrets, auto-run instructions, prompt injection patterns | | settings.json | Overly permissive allow lists, missing deny lists, dangerous bypass flags | | mcp.json | Risky MCP servers, hardcoded env secrets, npx supply chain risks | | hooks/ | Command injection via interpolation, data exfiltration, silent error suppression | | agents/*.md | Unrestricted tool access, prompt injection surface, missing model specs |

Salesforce-Specific Security Checks

Beyond configuration scanning, watch for these Salesforce vulnerability patterns:

SOQL Injection

// VULNERABLE — user input concatenated into query
String query = 'SELECT Id FROM Account WHERE Name = \'' + userInput + '\'';

// SAFE — bind variables
List<Account> results = [SELECT Id FROM Account WHERE Name = :userInput];

// SAFE — Database.queryWithBinds for dynamic SOQL
Map<String, Object> binds = new Map<String, Object>{ 'userInput' => userInput };
List<Account> results = Database.queryWithBinds(
    'SELECT Id FROM Account WHERE Name = :userInput',
    binds, AccessLevel.USER_MODE
);

FLS/CRUD Bypass

| Pattern | Risk | Fix | |---------|------|-----| | SOQL without WITH USER_MODE | Reads fields user can't see | Add WITH USER_MODE | | Database.insert(records) without AccessLevel | Skips FLS on write | Use AccessLevel.USER_MODE | | WITH SECURITY_ENFORCED | Throws on inaccessible fields, no sharing enforcement | Prefer WITH USER_MODE |

Sharing Model Violations

• without sharing on class with @AuraEnabled methods — privilege escalation
• without sharing on class with @RemoteAction — same risk via Visualforce
• Missing sharing declaration — inherits calling class context

XSS Patterns

• Visualforce: {!userInput} without JSENCODE, HTMLENCODE, or URLENCODE
• LWC: lwc:dom="manual" with innerHTML from user data
• Aura: $A.util.isEmpty() doesn't sanitize — validate before DOM insertion

Usage

AgentShield Scan

# Install and scan
npm install -g ecc-agentshield
npx ecc-agentshield scan

# With severity filter and JSON output for CI
npx ecc-agentshield scan --min-severity medium --format json

# Auto-fix safe issues
npx ecc-agentshield scan --fix

Severity Levels

| Grade | Score | Meaning | |-------|-------|---------| | A | 90-100 | Secure configuration | | B | 75-89 | Minor issues | | C | 60-74 | Needs attention | | D | 40-59 | Significant risks | | F | 0-39 | Critical vulnerabilities |

Manual Scanning (Without AgentShield)

# SOQL Injection — string concatenation in queries
grep -rn "Database.query" force-app/ --include="*.cls" | grep -v "bind"

# Missing sharing declaration
grep -rEL "with sharing|without sharing|inherited sharing" force-app/main/default/classes/*.cls

# Hardcoded Salesforce IDs (15 or 18 char)
grep -rnE "'00[0-9a-zA-Z]{12,15}'" force-app/ --include="*.cls"

# Missing CRUD/FLS on DML
grep -rn "insert \|update \|delete \|upsert " force-app/ --include="*.cls" | grep -v "stripInaccessible\|USER_MODE\|SECURITY_ENFORCED\|isAccessible\|@IsTest"

# Hardcoded endpoints
grep -rn "https://\|http://" force-app/ --include="*.cls" | grep -v "Named\|test\|mock\|example.com"

SF Code Analyzer Integration

# Full PMD scan
sf code-analyzer run --target force-app --format table

# Security-focused scan
sf code-analyzer run --target force-app --category "Security" --format table

Remediation Patterns

| Finding | Vulnerable Code | Fixed Code | |---------|----------------|------------| | SOQL Injection | Database.query('...WHERE Name=\'' + name + '\'') | [SELECT Id FROM Account WHERE Name = :name] | | Missing Sharing | public class MyService { | public with sharing class MyService { | | FLS Bypass | insert records; | Database.insert(records, AccessLevel.USER_MODE); | | Hardcoded ID | '012000000000ABC' | Schema.SObjectType.Account.getRecordTypeInfosByDeveloperName().get('Customer').getRecordTypeId() | | XSS (VF) | {!userInput} | {!HTMLENCODE(userInput)} |

Related

• Constraint: sf-security-constraints (co-activates for enforcement rules)
• Action: sf-security (CRUD/FLS implementation procedures)