security-scan

Scanning Claude Code configuration files for security vulnerabilities involves auditing your .claude directory to detect hardcoded secrets, misconfigurations, and injection risks. This Skill automates the process by checking files like CLAUDE.md, settings.json, and MCP server configs to identify exposed credentials before breaches occur.

Prompt injection risk in AI coding assistant environments refers to unsecured configurations allowing unauthorized commands or malicious inputs to manipulate agent behavior. Scanning validates hooks, agent definitions, and tool access settings to prevent attackers from compromising your project security through these configuration weaknesses.

Auditing MCP server configs and hooks for unauthorized tool access requires validating your Claude Code configuration directory against known security flaws. This process reviews agent definitions and settings.json to identify misconfigurations, ensuring tool permissions remain restricted and properly secured during project onboarding.

You can use this security scan during repository onboarding to verify existing Claude Code setups are safe. It checks core configuration files for hidden injection risks and exposed credentials, making it suitable for joining new teams to validate project security hygiene before contributing code.

Identified security risks are prioritized by assigning A-F security grades and categorizing findings by criticality, ranging from critical and high to medium and info. This grading system generates actionable remediation reports that help you address the most urgent configuration vulnerabilities first.

Automated configuration auditing for AI coding assistants is limited to scanning static configuration files like settings.json, CLAUDE.md, and MCP server configs. It validates pre-commit configuration states and detects known misconfigurations, but does not continuously monitor runtime agent behavior or block active real-time exploits.