security-scan

To audit Claude Code configurations for security vulnerabilities, you can run this Skill in your repository root to scan CLAUDE.md, settings.json, MCP configs, and hooks for hardcoded secrets, dangerous prompt patterns, and misconfigurations.

Security risks in CLAUDE.md and MCP configurations include hardcoded secrets, dangerous prompt patterns, and misconfigurations that could lead to leaks or breaches. Automated scanning detects these injection risks across your project files.

Yes, you need AgentShield installed to scan settings.json and hooks. This Skill relies on AgentShield to audit Claude Code configurations and detect security vulnerabilities, misconfigurations, and injection risks.

Yes, you can automatically fix misconfigurations and injection risks found during the audit. The Skill supports an optional auto-fix feature to tighten configurations after generating actionable security reports.

The security audit report for Claude Code projects supports JSON and Markdown formats. These reports provide actionable insights into vulnerabilities and misconfigurations found in your configuration files.

You should run a security scan on your Claude Code project during initial project setup, when onboarding to new repositories, or during periodic security hygiene checks to prevent leaks and breaches from configuration vulnerabilities.