security-scan

To check Claude Code configurations for security vulnerabilities, run an AgentShield scan from your project root to audit CLAUDE.md, settings.json, MCP configs, hooks, and agent definitions for risks and exposure.

Prompt injection in CLAUDE.md involves malicious instructions or auto-run commands that manipulate agent behavior. The scan detects these patterns alongside hardcoded secrets to prevent insecure deployments and data exposure.

Yes, you can scan MCP configurations and hooks for command injection risks. The audit reviews mcp.json for risky servers and supply-chain risks, and analyzes hooks for data exfiltration and silent error suppression.

To validate settings.json for overly permissive allow lists, the scan checks for missing deny lists and dangerous bypass flags, enforcing security best practices to prevent unauthorized access and insecure deployments.

Yes, the security scan applies to both new and existing Claude Code projects. It evaluates changes to CLAUDE.md, settings.json, MCP configurations, and agent definitions, making it suitable for ongoing security hygiene audits.

Security misconfigurations in Claude Code agents include unnecessary access controls, prompt-injection surface, and missing model specs. The scan verifies agents/*.md files to identify and remediate these exposure risks.