security-scan

To scan Claude Code configs for prompt injection risks, use a security-scan tool to audit your .claude/ directory. It parses configuration files, detects hardcoded secrets, and generates severity-graded security reports with remediation steps.

When checking Claude Code settings for security vulnerabilities before committing, scan for hardcoded secrets, overly permissive access controls, unrestricted Bash access, and command injection in hooks to prevent exploitation.

Security scanning for Claude Code requires the AgentShield tool to parse configuration files. It audits CLAUDE.md, settings.json, MCP server configs, hooks, and agent definitions to detect hardcoded secrets and misconfigurations.

To audit MCP server configs and hooks for command injection, run a multi-file security scan on your project's .claude/ directory. The scan identifies common vulnerability patterns and categorizes findings by criticality with clear fixes.

You should run a security scan on your Claude Code configuration directory during new project setup, before committing changes, or when onboarding to repositories with existing Claude Code configs to catch risks like unrestricted Bash access early.

The best way to review CLAUDE.md and settings.json for security misconfigurations is an automated scan that categorizes findings by criticality, from critical hardcoded secrets to minor missing deny lists, providing prioritized remediation steps.