Scan CLAUDE configuration files for security anti-patterns and generate findings.
npx skills add https://github.com/buvis/home --skill audit-security-buvis
Please help me install this Agent Skill. Skill: audit-security Source: https://github.com/buvis/home/tree/main/.claude/skills/audit-security Command: npx skills add https://github.com/buvis/home --skill audit-security-buvis
Scan ~/.claude/ config for security anti-patterns (permissive permissions, hook injection, risky MCP configs, hardcoded secrets). It helps teams identify risky configurations before they cause incidents.
Run the static security scanner against your CLAUDE configuration to generate a findings report.
High-intent search queries and answers about installing and using this skill.
To scan Claude configuration files for security issues, run a static scanner against ~/.claude/ settings.json files. It detects insecure permissions, hook injections, risky MCP servers, and hardcoded secrets, producing a structured findings report with severities and remediation guidance.
Security anti-patterns detected in Claude MCP server configurations include risky server settings, overly permissive permissions, hook injections, and embedded secrets. The static scanner analyzes per-project settings.json files to identify these risks and provide actionable remediation steps.
Yes, you can audit per-project Claude settings.json files for insecure permissions. The static scanner applies checks across both ~/.claude/ and per-project configuration files to highlight permission risks and generate a report-style summary suitable for audits.
The best way to find hardcoded secrets in Claude configuration is to run a static security scanner. It implements checks for claude-md secrets across settings files, identifying vulnerabilities early and providing remediation guidance to prevent incidents.
No, the Claude security scanner does not require any external dependencies to run. It operates as a standalone script component, performing static analysis on configuration files without needing additional tools or libraries installed.
Static analysis for Claude configuration security is limited to detecting known anti-patterns in settings.json files. It should not be relied upon as a sole measure for runtime vulnerabilities or dynamic MCP server behaviors not reflected in the static configuration.
ZESCODEScan Claude Code configuration files for secrets and misconfigurations.
diegocconsoliniScan Claude Code plugins for security vulnerabilities and insecure patterns.
rauly-1408Audit GitHub Actions workflows for AI agent security vulnerabilities.
Weihong-LiuAudit code for OWASP Top 10 vulnerabilities, hardcoded secrets, and unsafe patterns.
