security-scan

Scan Claude Code configurations for security vulnerabilities and misconfigurations.

Updated Mar 31, 2026

Search Tags:#security #audit #MCP #Claude Code #CLAUDE.md #settings.json #agent-shield

Ready to run

npx skills add https://github.com/GGEdu/claude-god-mode-template --skill security-scan-ggedu

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-scan
Source: https://github.com/GGEdu/claude-god-mode-template/tree/main/skills/security-scan
Command: npx skills add https://github.com/GGEdu/claude-god-mode-template --skill security-scan-ggedu

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Audit Claude Code configurations to detect security vulnerabilities, misconfigurations, and potential prompt injection risks before deployment.

Core Features & Use Cases

Automated security checks across CLAUDE.md, settings.json, MCP configs, hooks, and agent definitions.
Consolidated guidance for remediation, safe auto-fixes, and integration with CI workflows.
Use Case: A startup onboarding a new Claude Code project runs a security scan to validate there are no hardcoded secrets, overly permissive permissions, or risky MCP servers.

Quick Start

Run an automated scan of your .claude directory to identify and remediate security issues.

Frequently Asked Questions about security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit Claude Code configurations for security vulnerabilities?▼

Auditing Claude Code configurations involves scanning CLAUDE.md, settings.json, mcp.json, hooks, and agent definitions to detect misconfigurations and prompt injection risks. This Skill automates the process using AgentShield checks.

Can I run security scans on MCP servers and hooks in local repos?▼

Yes, security scans can be applied across local repos and CI pipelines to identify risky MCP servers and misconfigurations in hooks. The process enforces checks using AgentShield to validate configurations.

What is the best way to detect hardcoded secrets in Claude Code settings?▼

Detecting hardcoded secrets in Claude Code settings requires automated security checks on configuration files like settings.json and mcp.json. This Skill scans for overly permissive permissions and validates safe setups.

Does the security scan support auto-fix for misconfigurations in CLAUDE.md?▼

Yes, the security scan supports optional auto-fix to remediate misconfigurations and vulnerabilities found in CLAUDE.md and other Claude Code files. It provides consolidated guidance for applying safe fixes.

Can I integrate Claude Code security checks into CI workflows?▼

Integrating Claude Code security checks into CI workflows is supported to validate configurations before deployment. The scan outputs reports in multiple formats and enforces checks using AgentShield across pipelines.