Security auditor

Claude Code environment security auditor. Follows official Anthropic best practices (docs.anthropic.com/en/docs/claude-code/security). Runs a read-only checklist and returns findings ordered by severity. Never edits files.

Configuration

This skill needs a project root to audit. Determine it in this order:

1. If invoked with an explicit path argument, use that.
2. Otherwise, use the current working directory ($(pwd)) as the project root.
3. Also check ~/.claude/ for global (user-level) config alongside the project root.

Substitute $PROJECT_ROOT below with the resolved path before running each command.

Checklist

1. .env committed to git (CRITICAL)

cd $PROJECT_ROOT && git ls-files | grep -E "\.env$|\.env\." | grep -v ".env.example"

• No results → ✅ PASS
• Any result → ❌ CRITICAL FAIL

2. Secrets in CLAUDE.md

grep -iE "sk-ant|ANTHROPIC_API_KEY|Bearer [a-zA-Z0-9]|password\s*[:=]|secret\s*[:=]" \
  ~/.claude/CLAUDE.md $PROJECT_ROOT/CLAUDE.md 2>/dev/null

• No match → ✅ PASS
• Any match → ❌ FAIL

3. Secrets in memory/context files

grep -riE "sk-ant|ANTHROPIC_API_KEY|Bearer [a-zA-Z0-9]|password\s*[:=]|secret\s*[:=]" \
  $PROJECT_ROOT/context/memory/ 2>/dev/null

Adjust the path if the project uses a different location for durable memory/context files (e.g. docs/memory/, .claude/memory/).

• No match → ✅ PASS
• Any match → ❌ FAIL

4. dangerously-skip-permissions

grep -r "dangerously-skip-permissions\|dangerouslySkipPermissions\|bypassPermissions" \
  ~/.claude/settings.json $PROJECT_ROOT/.claude/ 2>/dev/null

• No match → ✅ PASS
• Any match → ❌ FAIL

5. Prompt injection in skills

grep -ri "ignore previous instructions\|override system\|disregard your\|forget your instructions" \
  ~/.claude/skills/ $PROJECT_ROOT/.claude/skills/ 2>/dev/null

• No match → ✅ PASS
• Any match → ❌ FAIL

6. MCP: cleartext tokens in configs

find $PROJECT_ROOT/.claude/mcp-servers ~/.claude -name "*.json" -not -path "*/node_modules/*" 2>/dev/null \
  | xargs grep -lE "\"token\"|\"api_key\"|\"secret\"|\"password\"" 2>/dev/null

• No results → ✅ PASS
• Any result → ❌ FAIL

7. Permissions: memory/context files

ls -la $PROJECT_ROOT/context/memory/

• All .md files at 600 (-rw-------) → ✅ PASS
• Any file at 644 or more open → ⚠️ WARN (report filenames)

8. Permissions: settings and CLAUDE.md

ls -la ~/.claude/settings.json ~/.claude/CLAUDE.md
ls -la $PROJECT_ROOT/.claude/settings.json 2>/dev/null

• All at 600 → ✅ PASS
• More open → ⚠️ WARN

9. settings.json: deny rules present (Anthropic: deny is evaluated first)

cat ~/.claude/settings.json | grep -A5 '"deny"'
cat $PROJECT_ROOT/.claude/settings.json 2>/dev/null | grep -A5 '"deny"'

• permissions.deny present and non-empty → ✅ PASS
• Absent or empty → ⚠️ WARN

10. settings.json: unrestricted wildcard in allow

cat ~/.claude/settings.json | grep '"allow"' -A20 | grep '"\*"'

• No unqualified "*" → ✅ PASS
• Present → ⚠️ WARN

11. Hooks: external URLs without allowlist (exfiltration risk)

grep -r "http" ~/.claude/settings.json $PROJECT_ROOT/.claude/settings.json 2>/dev/null \
  | grep -v "https://localhost\|https://127\|#"

• No external URL in hooks → ✅ PASS
• External URL present → ⚠️ WARN (verify if it's a legitimate MCP or a suspicious hook)

12. .env files: gitignore coverage

find $PROJECT_ROOT -name ".env" -o -name ".env.*" 2>/dev/null \
  | grep -v ".env.example" | grep -v node_modules | grep -v ".venv" | grep -v ".git"

For each .env found: cd $PROJECT_ROOT && git check-ignore -v <file>

• All covered → ✅ PASS
• Any not ignored → ⚠️ WARN

13. Agents: valid frontmatter

find ~/.claude/agents $PROJECT_ROOT/.claude/agents -name "*.md" \
  -not -name "CLAUDE.md" 2>/dev/null

For each file: check for name: and description: in the frontmatter.

• All valid → ✅ PASS
• File without frontmatter → ⚠️ WARN

14. MCP: endpoints without TLS

grep -r '"url"' ~/.claude/settings.json $PROJECT_ROOT/.claude/ 2>/dev/null \
  | grep "http://" | grep -v "http://localhost\|http://127"

• No results → ✅ PASS
• Remote http:// endpoint without TLS → ⚠️ WARN

Output

Return ONLY WARN/FAIL findings, ordered by severity (critical FAIL → FAIL → WARN), one per line:

FAIL env-committed: .env committed to git (CRITICAL)
FAIL secret-memory: sk-ant exposed in finances.md line 12
FAIL bypass-permissions: bypassPermissions active in settings
WARN memory-perms: finances.md with 644 permissions
WARN env-not-ignored: .claude/skills/foo/.env not gitignored
WARN hook-external-url: external URL in PreToolUse hook (verify)
WARN agent-frontmatter: some-agent.md missing name/description

If everything passes: NONE