security-scan

To scan Claude Code configurations for security vulnerabilities, run the security scan against your project's .claude/ directory. It audits CLAUDE.md, settings.json, and MCP servers using AgentShield to detect hardcoded secrets, command injection, and unrestricted tool access risks.

AgentShield detects security misconfigurations in Claude Code by analyzing hooks, agent definitions, and configuration files for hardcoded secrets, command injection vulnerabilities, and unrestricted tool access. It then provides severity grading for each identified risk.

You can automatically fix hardcoded secrets and injection risks in CLAUDE.md and settings.json using the Skill's auto-fix capabilities. It applies safe fixes to identified vulnerabilities and misconfigurations found during the configuration security scan.

The security scan requires the AgentShield dependency to audit MCP servers and hooks. It leverages this dependency to analyze agent definitions and configuration structures for potential command injection and unrestricted tool access vulnerabilities.

You should run a Claude Code configuration security scan before deploying a new feature or committing configuration changes. This proactively catches security oversights in your setup, preventing potential breaches or misconfigurations in your development environment.