skills.rest
luongldptit
luongldptitCOMMUNITY
Explore all skills by this author →
GitHub

security-scan

Scans Claude Code configs for vulnerabilities and outputs severity-graded reports.

Updated Mar 26, 2026
Search Tags:#ci-cd#claude-code#configuration-audit#security-scan#vulnerability-scanning#prompt-injection#agentshield
One-click install
npx skills add https://github.com/luongldptit/move-ticket --skill security-scan-luongldptit
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-scan
Source: https://github.com/luongldptit/move-ticket/tree/main/.agent/skills/security-scan
Command: npx skills add https://github.com/luongldptit/move-ticket --skill security-scan-luongldptit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Claude Code configuration files in the .claude/ directory often contain unaddressed security gaps like hardcoded secrets, overly permissive permissions, and prompt injection vectors that can lead to data breaches, unauthorized tool access, or malicious code execution. Manually reviewing these configs is time-consuming and error-prone, especially for complex projects with multiple agent definitions and MCP server integrations.

Core Features & Use Cases

  • Comprehensive Config Scanning: Audits CLAUDE.md, settings.json, mcp.json, hooks, and agent definition files for hardcoded secrets, permission misconfigurations, command injection risks, and prompt injection patterns.
  • Flexible Output & Integration: Supports terminal, JSON, Markdown, and HTML output formats, plus native GitHub Action integration for CI/CD security pipelines.
  • Use Case: When onboarding to a new repository with existing Claude Code configs, run this scan to identify critical issues like unrestricted Bash access or hardcoded API keys before they expose your project to risk.

Quick Start

Use the security-scan skill to audit your current project's Claude Code configuration for security vulnerabilities and generate a detailed severity-graded report.

Frequently Asked Questions about security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan Claude Code configuration files for security vulnerabilities?▼

You can scan Claude Code configurations for security vulnerabilities by auditing the .claude directory to detect hardcoded secrets, permission misconfigurations, and command injection vectors, generating a severity-graded audit report.

What security risks exist in Claude Code CLAUDE.md and settings.json files?▼

Claude Code configuration files like CLAUDE.md and settings.json often contain security risks including hardcoded secrets, overly permissive permissions, and prompt injection vectors that can lead to unauthorized tool access or malicious code execution.

Can I integrate Claude Code config auditing into a CI/CD pipeline?▼

Yes, you can integrate Claude Code config auditing into CI/CD security pipelines using native GitHub Action support, enabling automated pre-commit configuration validation to catch command injection risks and misconfigurations before deployment.

Does AgentShield work with Claude Code MCP server integrations and hooks?▼

AgentShield parses Claude Code configuration files including mcp.json, hooks, and agent definition files, allowing it to audit MCP server integrations for hardcoded secrets, permission misconfigurations, and prompt injection patterns.

What is the best way to generate a security audit report for Claude Code environments?▼

The best way to generate a security audit report for Claude Code environments is to scan configuration directories for vulnerabilities and output severity-graded results in terminal, JSON, Markdown, or HTML formats for periodic security hygiene checks.

Related Skills

Explore More Software Engineering Skills→
sakamoto-family-smilesakamoto-family-smile

security-scan

Audit Claude Code configuration files for security vulnerabilities and misconfigurations.

Community
Advanced
SocketDevSocketDev
56

scanning-security

Scan repository configurations and GitHub workflows for security risks and misconfigurations.

Official
Intermediate
LSDIPPOLLCLSDIPPOLLC

harnesscp-permissions

Configure Copilot permission boundaries for agent tools and PreToolUse hooks.

Official
Advanced
Michae2xlMichae2xl

security-scan

Scan Claude Code configurations for security vulnerabilities using AgentShield.

Community
Advanced