skills.rest
ThalesAndrades
ThalesAndradesCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-scan

Analyze Claude Code configuration files and hooks for security vulnerabilities.

Updated Aug 27, 2026
Search Tags:#security#injection#compliance#configuration#code audit#vulnerabilities
One-click install
npx skills add https://github.com/ThalesAndrades/forumfoup2026 --skill security-scan-thalesandrades
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-scan
Source: https://github.com/ThalesAndrades/forumfoup2026/tree/main/.claude/skills/security-scan
Command: npx skills add https://github.com/ThalesAndrades/forumfoup2026 --skill security-scan-thalesandrades

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires ecc-agentshield, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps identify security vulnerabilities, misconfigurations, and injection risks within Claude Code setup files and hooks, enhancing overall security posture.

Core Features & Use Cases

  • Configuration Auditing: Checks CLAUDE.md, settings.json, mcp.json, and hook scripts for common security issues.
  • Risk Detection: Detects hardcoded secrets, command injection points, and permissive allow lists.
  • Use Case: When onboarding a new project or updating configs, run this Skill to ensure security best practices are followed before deployment or sharing.

Quick Start

Run the security scan on your current Claude project directory to identify potential vulnerabilities and misconfigurations.

Frequently Asked Questions about security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit Claude Code configuration files for security vulnerabilities?▼

You can audit Claude Code configuration files by running a security scan on your project directory to detect misconfigurations, hardcoded secrets, and injection risks in files like CLAUDE.md, settings.json, and mcp.json.

What security risks should I look for in Claude Code hooks and settings?▼

Security scans for Claude Code hooks and settings look for hardcoded secrets, command injection points, and overly permissive allow lists that could compromise your project's security integrity.

Do I need AgentShield to scan Claude Code configurations for vulnerabilities?▼

Yes, you need to install the AgentShield dependency to perform a comprehensive security evaluation of your Claude Code configurations and detect injection risks effectively.

When should I run a security audit on my Claude Code project setup?▼

You should run a security audit during project onboarding, before deployment, or whenever you update Claude Code configurations and hooks to ensure security best practices are followed.

Can I detect hardcoded secrets and command injection points in mcp.json and settings.json?▼

Yes, a Claude Code security scan analyzes mcp.json and settings.json to identify hardcoded secrets, command injection points, and permissive allow lists to improve your environment's security posture.

What are the limitations of using a security scan for Claude Code environments?▼

This security scan is limited to detecting vulnerabilities and misconfigurations in Claude Code configuration files and hooks, requiring AgentShield for comprehensive evaluation rather than serving as a full application code audit.

Related Skills

Explore More Software Engineering Skills→
firstsun-devfirstsun-dev

security-scan

Audit Claude Code configurations for security weaknesses and misconfigurations.

Official
Advanced
KimjimanKimjiman

security-scan

Scan Claude Code configurations for security vulnerabilities and misconfigurations.

Community
Advanced
nanorepublicananorepublica
61

Global Tech Stack

Validate code against centralized global tech stack standards.

Community
Basic
az9713az9713

dependency-audit

Audit project dependencies for vulnerabilities, license issues, and bloat.

Community
Intermediate