security-scan

Scan Claude Code configurations for security vulnerabilities and misconfigurations.

1|Updated Mar 18, 2026

Search Tags:#security #audit #hooks #mcp #config #claude-code

Ready to run

npx skills add https://github.com/ValenBorras/upscribe --skill security-scan-valenborras

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-scan
Source: https://github.com/ValenBorras/upscribe/tree/main/.github/skills/security-scan
Command: npx skills add https://github.com/ValenBorras/upscribe --skill security-scan-valenborras

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Scan Claude Code configurations (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions.

Core Features & Use Cases

Performs comprehensive scans of CLAUDE.md for secrets and prompt-injection vectors
Validates settings.json and MCP configurations to detect risky permissions and misconfigurations
Audits hooks and agent definitions to surface access risks and unsafe tooling

Quick Start

Run a security scan on your Claude Code configuration to identify vulnerabilities.

Frequently Asked Questions about security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit Claude Code configurations for security vulnerabilities?▼

To audit Claude Code configurations for security vulnerabilities, scan the .claude/ directory including CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions to detect secrets, prompt injections, and data exposure risks.

What security risks should I check for in MCP servers and hooks?▼

When scanning MCP servers and hooks for security risks, validate configurations to detect risky permissions, misconfigurations, unsafe tooling access, and potential prompt injection vectors that could expose sensitive data.

Do I need AgentShield installed to scan Claude Code settings?▼

Yes, you need AgentShield installed to scan Claude Code settings, as the security scan requires AgentShield to read configuration files and detect secrets, prompt injections, risky MCP servers, and data exposure risks.

When should I run a security audit on my Claude Code project?▼

You should run a security audit on your Claude Code project during initial project setup, after making configuration changes, and periodically for security hygiene across repositories to identify and remediate vulnerabilities.

Can I export Claude Code security scan results to JSON or Markdown?▼

Yes, you can export Claude Code security scan results to JSON or Markdown formats, as the scan presents vulnerability findings in terminal, JSON, or Markdown outputs for integration into reports and workflows.

What is the best way to detect prompt injection in CLAUDE.md files?▼

The best way to detect prompt injection in CLAUDE.md files is performing a comprehensive security scan that reads the configuration content and identifies injection vectors alongside secrets and risky permission misconfigurations.