skills.rest
BinyaminEden
BinyaminEdenCOMMUNITY
Explore all skills by this author →
GitHub

security-scan

Audit Claude Code .claude configuration directories for security vulnerabilities.

26|1|Updated Mar 19, 2026
Search Tags:#claude-code#misconfiguration#security-scan#vulnerability-scanning#prompt-injection#agentshield#config-audit
One-click install
npx skills add https://github.com/BinyaminEden/claude-combine --skill security-scan-binyamineden
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-scan
Source: https://github.com/BinyaminEden/claude-combine/tree/main/skills/security-scan
Command: npx skills add https://github.com/BinyaminEden/claude-combine --skill security-scan-binyamineden

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Manually reviewing Claude Code configuration files for security issues is error-prone and time-consuming, leaving projects vulnerable to hardcoded secrets, prompt injection, and misconfigured permissions that could lead to data breaches or unauthorized access.

Core Features & Use Cases

  • Multi-File Security Audit: Scans CLAUDE.md, settings.json, MCP server configs, hooks, and agent definitions for common security flaws.
  • Actionable Remediation Guidance: Categorizes findings by severity (A-F grade) and provides clear steps to fix critical, high, and medium risk issues.
  • Use Case: Before pushing .claude configuration changes to a shared team repository, run this scan to catch hardcoded API keys or dangerous hook command injection patterns that could expose sensitive project data.

Quick Start

Use the security-scan skill to audit your current project's .claude directory for security vulnerabilities and receive a prioritized remediation report.

Frequently Asked Questions about security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan Claude Code configuration files for security vulnerabilities?▼

This skill audits your .claude directory to scan Claude Code configurations for security vulnerabilities. It identifies hardcoded secrets, prompt injection patterns, and misconfigured permissions across CLAUDE.md, settings.json, and MCP server configs.

What security risks should I check for in CLAUDE.md and settings.json before committing?▼

Before committing, check CLAUDE.md and settings.json for hardcoded API keys, dangerous hook command injection patterns, and overly permissive permissions. These misconfigurations could expose sensitive project data to unauthorized access.

Can I audit MCP server configs and hooks for prompt injection risks?▼

Yes, you can audit MCP server configs and hooks for prompt injection risks. The scan leverages AgentShield to inspect agent definitions and hook commands, categorizing command injection findings by severity level.

When should I run a security audit on my .claude directory?▼

Run a security audit on your .claude directory during project setup, before pushing configuration changes to a shared team repository, during repository onboarding, and for periodic security hygiene checks to catch misconfigurations early.

Does the config audit provide remediation steps for detected vulnerabilities?▼

Yes, the config audit provides remediation steps for detected vulnerabilities. It categorizes findings using an A-F severity grade and delivers clear, actionable guidance to fix critical, high, and medium risk issues.

Related Skills

Explore More Software Engineering Skills→
bitwardenbitwarden
129

reviewing-claude-config

Review Claude Code configuration files for security risks and quality issues.

Official
Basic
RambleRainbowRambleRainbow

security-scan

Scan Claude Code configuration directories for security vulnerabilities and misconfigurations.

Community
Intermediate
yurukusayurukusa
4

cc-safe-setup

Install pre-built hooks that block dangerous file, git, and credential actions in Claude Code.

Community
Intermediate
klu-devklu-dev
2

security-scan

Detect security vulnerabilities and misconfigurations in Claude Code configurations with AgentShield.

Community
Advanced