skills.rest
BuildSmarterAI
BuildSmarterAICOMMUNITY
Explore all skills by this author →
GitHub

security-scan

Scan Claude Code configurations for vulnerabilities, misconfigurations, and prompt-injection vectors.

Updated Mar 31, 2026
Search Tags:#security#vulnerabilities#claude-code#prompt-injection#misconfigurations#agentshield#claude-md-checks
One-click install
npx skills add https://github.com/BuildSmarterAI/claude-skills --skill security-scan-buildsmarterai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-scan
Source: https://github.com/BuildSmarterAI/claude-skills/tree/main/security-scan
Command: npx skills add https://github.com/BuildSmarterAI/claude-skills --skill security-scan-buildsmarterai

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Audit Claude Code configurations to detect security vulnerabilities, misconfigurations, and prompt-injection risks across CLAUDE.md, settings.json, MCP configurations, hooks, and agent definitions.

Core Features & Use Cases

  • CLAUDE.md checks: Detect hardcoded secrets, prompt-injection vectors, and risky inline instructions.
  • Settings & MCP validation: Flag overly permissive allow lists, missing deny lists, and dangerous bypass flags.
  • Hook & agent audit: Review hooks and agent definitions for exposure and data exfiltration risks.

Quick Start

Run a security scan against your repository's Claude Code configuration with AgentShield.

Frequently Asked Questions about security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan Claude Code configurations for prompt-injection vulnerabilities?▼

Scan Claude Code configurations for prompt-injection vulnerabilities by analyzing CLAUDE.md files, settings.json, and MCP configs to detect risky inline instructions and exposure vectors. The skill enforces a deterministic workflow to identify and remediate these security risks.

What security misconfigurations can be detected in MCP and settings files?▼

Security misconfigurations detected in MCP and settings files include overly permissive allow lists, missing deny lists, and dangerous bypass flags. The scan audits settings.json and mcp.json to flag these configuration weaknesses and data exfiltration risks.

Do I need AgentShield to audit Claude Code hooks and agent definitions?▼

Yes, you need AgentShield installed to audit Claude Code hooks and agent definitions. The skill enforces a deterministic workflow by requiring AgentShield installation to verify report-ready outputs and review agent definitions for data exfiltration risks.

Can I integrate Claude Code security scans into a CI/CD pipeline?▼

Yes, you can integrate Claude Code security scans into a CI/CD pipeline. The skill verifies report-ready outputs and enforces a deterministic workflow, enabling seamless automated security hygiene checks during ongoing operations or after configuration changes.

When should I run a security scan on my Claude Code repository?▼

Run a security scan on your Claude Code repository when starting new projects, after changes to CLAUDE files, MCP configs, or hooks, or during ongoing security hygiene. This ensures continuous detection of hardcoded secrets and misconfigurations.

Related Skills

Explore More Software Engineering Skills→
arbisoftarbisoft
4

security-scan

Audit Claude Code configurations for security vulnerabilities using AgentShield.

Official
Intermediate
weirdgmeweirdgme
4

devsecops

Automate security integration across CI/CD pipelines with policy-as-code enforcement.

Community
Advanced
emiled16emiled16

security-scan

Audit Claude Code configuration files for security vulnerabilities and misconfigurations.

Community
Intermediate
KimjimanKimjiman

security-scan

Scan Claude Code configurations for security vulnerabilities and misconfigurations.

Community
Advanced