security-scan

To scan Claude Code configuration files for security vulnerabilities, run an audit on your .claude directory. This analyzes CLAUDE.md, settings.json, mcp.json, hooks, and agent definitions for hard-coded secrets, dangerous permissions, and prompt-injection risks, producing a severity-rated report.

Prompt injection risk detection in Claude Code agent definitions identifies malicious patterns in CLAUDE.md, hooks, and agent configurations that could compromise agents, servers, or data. It flags injection vectors during local development, CI checks, or scheduled audits.

Yes, you can run a Claude Code configuration audit in CI pipelines. The scan integrates into CI checks to analyze .claude directory files before merging configuration changes or onboarding repositories, generating terminal, JSON, Markdown, or HTML severity-rated reports.

Opus deep analysis during Claude Code configuration scanning requires an ANTHROPIC_API_KEY. This enables red-team style adversarial analysis of configuration files, while standard severity-rated scans and automated safe fixes do not require it.

To auto-fix hard-coded secrets and permissive allowances in settings.json, use the automated remediation feature with AgentShield. It optionally applies safe fixes to replace exposed secrets and tighten dangerous permissions found during the configuration audit.

Automated fixes for Claude Code misconfigurations are limited to applying only safe remediations, such as replacing hard-coded secrets and tightening permissive allowances. Complex or ambiguous prompt-injection vectors may require manual review or Opus deep analysis to resolve.