security-scan

Name: security-scan
Availability: InStock
Author: buildsmarterai

Scan Claude Code configurations for vulnerabilities, misconfigurations, and prompt-injection vectors.

Updated Mar 31, 2026

Search Tags:#security #vulnerabilities #claude-code #prompt-injection #misconfigurations #agentshield #claude-md-checks

Ready to run

npx skills add https://github.com/BuildSmarterAI/claude-skills --skill security-scan-buildsmarterai

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-scan
Source: https://github.com/BuildSmarterAI/claude-skills/tree/main/security-scan
Command: npx skills add https://github.com/BuildSmarterAI/claude-skills --skill security-scan-buildsmarterai

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Audit Claude Code configurations to detect security vulnerabilities, misconfigurations, and prompt-injection risks across CLAUDE.md, settings.json, MCP configurations, hooks, and agent definitions.

Core Features & Use Cases

CLAUDE.md checks: Detect hardcoded secrets, prompt-injection vectors, and risky inline instructions.
Settings & MCP validation: Flag overly permissive allow lists, missing deny lists, and dangerous bypass flags.
Hook & agent audit: Review hooks and agent definitions for exposure and data exfiltration risks.

Quick Start

Run a security scan against your repository's Claude Code configuration with AgentShield.

Frequently Asked Questions about security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan Claude Code configurations for prompt-injection vulnerabilities?▼

Scan Claude Code configurations for prompt-injection vulnerabilities by analyzing CLAUDE.md files, settings.json, and MCP configs to detect risky inline instructions and exposure vectors. The skill enforces a deterministic workflow to identify and remediate these security risks.

What security misconfigurations can be detected in MCP and settings files?▼

Security misconfigurations detected in MCP and settings files include overly permissive allow lists, missing deny lists, and dangerous bypass flags. The scan audits settings.json and mcp.json to flag these configuration weaknesses and data exfiltration risks.

Do I need AgentShield to audit Claude Code hooks and agent definitions?▼

Yes, you need AgentShield installed to audit Claude Code hooks and agent definitions. The skill enforces a deterministic workflow by requiring AgentShield installation to verify report-ready outputs and review agent definitions for data exfiltration risks.

Can I integrate Claude Code security scans into a CI/CD pipeline?▼

Yes, you can integrate Claude Code security scans into a CI/CD pipeline. The skill verifies report-ready outputs and enforces a deterministic workflow, enabling seamless automated security hygiene checks during ongoing operations or after configuration changes.

When should I run a security scan on my Claude Code repository?▼

Run a security scan on your Claude Code repository when starting new projects, after changes to CLAUDE files, MCP configs, or hooks, or during ongoing security hygiene. This ensures continuous detection of hardcoded secrets and misconfigurations.