ECC AgentShield: A "Plumbing Inspection" Security Audit for AI Agents
> Project: affaan-m/ECC > Repository: https://github.com/affaan-m/ECC > Language: JavaScript | Stars today: +1015 | v2.2.3
1. The "In-Wall Plumbing" Problem of AI Agents
You install an MCP server for Claude Code so it can read your database. You configure a hook for Cursor so tests run automatically on every file save. You write a prompt for Codex that lets it access your GitHub repository.
These configurations are like a house's plumbing—buried in the walls, invisible day-to-day, but when they leak, the whole wall has to be torn open.
Traditional security tools don't check these. Your antivirus scans .exe files but won't scan your MCP config for hardcoded secrets. Your firewall blocks network attacks but won't block a malicious prompt injection.
What ECC's AgentShield does is exactly this: a security inspection of the AI agent's "in-wall plumbing."
2. Six Hidden Attack Surfaces of Agents
AgentShield scans six attack surfaces that traditional security tools don't cover:
| Attack Surface | Risk | Covered by Traditional Tools? | |--------|------|---------------| | Prompts | prompt injection, unauthorized instructions | No | | Hooks | hook injection, malicious auto-execution | No | | MCP config | over-privileged MCP servers, unauthorized access | No | | Permissions | misconfigured permissions, over-granting | Partially | | Secrets | hardcoded API keys, token leakage | Yes (but only scans code, not configs) | | Agent files | malicious skills, malicious agent definitions | No |
These six surfaces share one trait: they are "configuration," not "code." Traditional security tools scan code vulnerabilities (SQL injection, XSS, buffer overflows), but AI agent attack surfaces live at the configuration layer—how your prompt is written, what your hook executes, what your MCP server can access.
It's like a traditional safety inspection that checks a house's structure (load-bearing walls, foundation) but not the plumbing (water pipes, wiring, gas lines). In the AI agent era, "plumbing" has become the new attack surface.
3. 1,282 Checks: From "Does It Exist" to "Is It Correct"
AgentShield isn't a simple "is there a hardcoded secret" checker. It runs 1,282 checks covering:
- Secret scanning: API keys, tokens, passwords, private keys
- Permission audits: whether the agent has unnecessary write, execution, or network permissions
- Hook injection detection: whether hooks execute unaudited commands or can be triggered by external input
- MCP risk assessment: whether MCP servers use unencrypted communication or expose sensitive APIs
- Prompt injection detection: whether prompts contain injectable instruction patterns
- Agent file integrity: whether skills and agent definitions have been tampered with
- 71 prebuilt agents: each a role definition (code reviewer, security auditor, test writer, etc.)
- 311 skills: each a reusable capability unit (formatting code, running tests, looking up docs, etc.)
- 97 commands: each an executable shortcut
- Repository: https://github.com/affaan-m/ECC
- Homepage: https://ecc.tools
- AgentShield: https://github.com/affaan-m/agentshield
These 1,282 checks aren't binary "does it exist" judgments—they're "is it correct" configuration audits. For example, "your MCP server can access the database" isn't a vulnerability, but "your MCP server can access the database with no permission restrictions" is a misconfiguration.
4. Plan→Test→Implement→Review→Verify→Remember→Improve
AgentShield is part of the larger ECC framework. ECC's core is a seven-step loop:
1. Plan: the agent plans the task first, doesn't dive in 2. Test: write tests first, not implementation 3. Implement: implement features only with tests passing 4. Review: the agent self-reviews code 5. Verify: validate security with AgentShield 6. Remember: store the lessons into memory 7. Improve: use experience to improve the next plan
The elegance of this loop is that Verify comes before Remember: the agent validates its work is secure first, then stores the verification results in memory for future improvement.
It resembles the scientific method: hypothesis (Plan) → experiment (Test) → observation (Implement) → peer review (Review) → reproducibility check (Verify) → publication (Remember) → iteration (Improve). ECC applies this loop to software development, with dedicated agents and skills for each step.
5. 71 Agents, 311 Skills, 97 Commands
The scale of ECC v2.2:
The numbers themselves don't matter—what matters is how they're organized. ECC doesn't lay 311 skills out flat for you to pick from; it organizes them into workflows of "which agent uses which skill at which step." The code reviewer agent uses the code-review skill at the Review step; the security auditor agent uses the AgentShield skill at the Verify step.
It's like a hospital's department structure: instead of piling all doctors together, they're organized into a care process—internal medicine → surgery → imaging → labs. ECC's 71 agents are 71 "specialists," 311 skills are 311 "diagnostic tools," and 97 commands are 97 "prescriptions."
6. Single Maintainer, Seven Platforms
ECC's most counterintuitive fact: maintained by one person, supporting seven platforms.
Claude Code, Codex, Cursor, OpenCode, Gemini, Zed, GitHub Copilot—seven different AI coding agents, each with its own config format, hook mechanism, and skill system. ECC unifies them with an "adapter layer."
This isn't a technical problem—it's an engineering discipline problem. A single maintainer keeping up with API changes across seven platforms with weekly releases relies not on "effort" but on "architecture." ECC's design is harness-agnostic: core logic and platform adaptation are separated, so adding a new platform only requires writing an adapter, without touching the core.
It's like Linux's driver model: the kernel stays unchanged, and adding new hardware only requires writing a driver. ECC applies the same principle to AI agent platforms.
7. MIT Forever Free + Pro Subscription
ECC's business model is also worth noting. The core repository is MIT licensed, free forever. The Pro version is a hosted GitHub App supporting private repositories at $19/seat/month.
The elegance of this model: open core + hosted value-add. Individual developers are fully served by the free version (MIT, no restrictions); enterprise teams use Pro to skip self-hosting hassles. Sponsors and Pro subscribers fund open-source development, forming a sustainable loop.
This is cleaner than "open-source core features, closed-source advanced features"—no crippled core; you pay only for convenience. AgentShield is included in the free version too—security isn't paywalled.
8. Why Agent Security Is the Next Big Problem
AI coding agents have ever-larger permissions. They can read your code, write your files, run your commands, access your databases. These permissions are necessary—without them, agents can't do work for you.
But bigger permissions mean a bigger attack surface. A malicious MCP server can steal your API keys. An injected prompt can make an agent execute rm -rf /. A misconfigured hook can leak your code to an external server on every file save.
Traditional security tools don't cover this. They scan code vulnerabilities, not configuration vulnerabilities. They check for network attacks, not prompt injections. They protect your servers, not your agents.
What AgentShield does isn't "inventing a new security technique"—it's "applying existing security audit methods to AI agents' new attack surfaces." Its value isn't technical novelty but coverage: 1,282 checks spanning six attack surfaces traditional tools ignore.
It's like a fire inspection: not inventing new firefighting technology, but applying existing checklists to a new building type. That "application" itself has value—because no one has done it, because AI agents are a new "building type" that needs new "fire codes."
---
Links