security-scan

Scanning Claude Code configs for prompt injection vulnerabilities involves auditing CLAUDE.md, settings.json, and MCP configs to detect injection risks and unauthorized access paths. The security-scan skill automates this by producing severity-graded reports with remediation guidance.

Auditing MCP servers for security misconfigurations requires checking configuration files for overly permissive settings or hardcoded secrets. This skill reviews MCP configs and agent definitions to identify unauthorized command execution risks and sensitive data exposure.

You can validate Claude Code settings.json before pushing to a shared repository by running a configuration audit. This skill scans core files for hardcoded API keys and missing deny lists, providing a prioritized list of required fixes to prevent credential exposure.

The security-scan skill does check agent markdown definitions for unauthorized access risks. It comprehensively scans agent definitions alongside CLAUDE.md and hooks to identify misconfigurations that could allow unauthorized system access.

Fixing hardcoded API keys found during a Claude Code security audit requires removing the secrets and rotating exposed credentials. This skill provides optional automated fixes for eligible issues and clear remediation guidance within its severity-graded reports.

You need to run a Claude Code configuration security scan during new project setups, pre-commit validation, repository onboarding with existing configs, and routine security hygiene audits. This prevents unauthorized system access and sensitive data exposure.