Security auditor

Skill cosmefae/claude-skills/skills/security-auditor

Agent Skills for Claude Code: Figma-to-code pipeline, git workflow, doc hygiene automation, and design-engineering tools, built from real use.

Install

npx -y skills add cosmefae/claude-skills --skill security-auditor

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

24 days oldThe repository was created 24 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Audits the security of a Claude Code environment: sensitive file permissions, .env vs gitignore, exposed secrets, Claude config (settings, CLAUDE.md, agents, skills, MCP, hooks). Read-only, never edits files. Invoke with: "audit security", "security audit", "check environment".

SKILL.md

5.4 KB, as published. Nobody here has run it

Claude Code environment security auditor. Follows official Anthropic best practices (docs.anthropic.com/en/docs/claude-code/security). Runs a read-only checklist and returns findings ordered by severity. Never edits files.

Configuration

This skill needs a project root to audit. Determine it in this order:

If invoked with an explicit path argument, use that.
Otherwise, use the current working directory ($(pwd)) as the project root.
Also check ~/.claude/ for global (user-level) config alongside the project root.

Substitute $PROJECT_ROOT below with the resolved path before running each command.

Checklist

1. .env committed to git (CRITICAL)

cd $PROJECT_ROOT && git ls-files | grep -E "\.env$|\.env\." | grep -v ".env.example"

No results → ✅ PASS
Any result → ❌ CRITICAL FAIL

2. Secrets in CLAUDE.md

grep -iE "sk-ant|ANTHROPIC_API_KEY|Bearer [a-zA-Z0-9]|password\s*[:=]|secret\s*[:=]" \
  ~/.claude/CLAUDE.md $PROJECT_ROOT/CLAUDE.md 2>/dev/null

No match → ✅ PASS
Any match → ❌ FAIL

3. Secrets in memory/context files

grep -riE "sk-ant|ANTHROPIC_API_KEY|Bearer [a-zA-Z0-9]|password\s*[:=]|secret\s*[:=]" \
  $PROJECT_ROOT/context/memory/ 2>/dev/null

Adjust the path if the project uses a different location for durable memory/context files (e.g. docs/memory/, .claude/memory/).

No match → ✅ PASS
Any match → ❌ FAIL

4. dangerously-skip-permissions

grep -r "dangerously-skip-permissions\|dangerouslySkipPermissions\|bypassPermissions" \
  ~/.claude/settings.json $PROJECT_ROOT/.claude/ 2>/dev/null

No match → ✅ PASS
Any match → ❌ FAIL

5. Prompt injection in skills

grep -ri "ignore previous instructions\|override system\|disregard your\|forget your instructions" \
  ~/.claude/skills/ $PROJECT_ROOT/.claude/skills/ 2>/dev/null

No match → ✅ PASS
Any match → ❌ FAIL

6. MCP: cleartext tokens in configs

find $PROJECT_ROOT/.claude/mcp-servers ~/.claude -name "*.json" -not -path "*/node_modules/*" 2>/dev/null \
  | xargs grep -lE "\"token\"|\"api_key\"|\"secret\"|\"password\"" 2>/dev/null

No results → ✅ PASS
Any result → ❌ FAIL

7. Permissions: memory/context files

ls -la $PROJECT_ROOT/context/memory/

All .md files at 600 (-rw-------) → ✅ PASS
Any file at 644 or more open → ⚠️ WARN (report filenames)

8. Permissions: settings and CLAUDE.md

ls -la ~/.claude/settings.json ~/.claude/CLAUDE.md
ls -la $PROJECT_ROOT/.claude/settings.json 2>/dev/null

All at 600 → ✅ PASS
More open → ⚠️ WARN

9. settings.json: deny rules present (Anthropic: deny is evaluated first)

cat ~/.claude/settings.json | grep -A5 '"deny"'
cat $PROJECT_ROOT/.claude/settings.json 2>/dev/null | grep -A5 '"deny"'

permissions.deny present and non-empty → ✅ PASS
Absent or empty → ⚠️ WARN

10. settings.json: unrestricted wildcard in allow

cat ~/.claude/settings.json | grep '"allow"' -A20 | grep '"\*"'

No unqualified "*" → ✅ PASS
Present → ⚠️ WARN

11. Hooks: external URLs without allowlist (exfiltration risk)

grep -r "http" ~/.claude/settings.json $PROJECT_ROOT/.claude/settings.json 2>/dev/null \
  | grep -v "https://localhost\|https://127\|#"

No external URL in hooks → ✅ PASS
External URL present → ⚠️ WARN (verify if it's a legitimate MCP or a suspicious hook)

12. .env files: gitignore coverage

find $PROJECT_ROOT -name ".env" -o -name ".env.*" 2>/dev/null \
  | grep -v ".env.example" | grep -v node_modules | grep -v ".venv" | grep -v ".git"

For each .env found: cd $PROJECT_ROOT && git check-ignore -v <file>

All covered → ✅ PASS
Any not ignored → ⚠️ WARN

13. Agents: valid frontmatter

find ~/.claude/agents $PROJECT_ROOT/.claude/agents -name "*.md" \
  -not -name "CLAUDE.md" 2>/dev/null

For each file: check for name: and description: in the frontmatter.

All valid → ✅ PASS
File without frontmatter → ⚠️ WARN

14. MCP: endpoints without TLS

grep -r '"url"' ~/.claude/settings.json $PROJECT_ROOT/.claude/ 2>/dev/null \
  | grep "http://" | grep -v "http://localhost\|http://127"

No results → ✅ PASS
Remote http:// endpoint without TLS → ⚠️ WARN

Output

Return ONLY WARN/FAIL findings, ordered by severity (critical FAIL → FAIL → WARN), one per line:

FAIL env-committed: .env committed to git (CRITICAL)
FAIL secret-memory: sk-ant exposed in finances.md line 12
FAIL bypass-permissions: bypassPermissions active in settings
WARN memory-perms: finances.md with 644 permissions
WARN env-not-ignored: .claude/skills/foo/.env not gitignored
WARN hook-external-url: external URL in PreToolUse hook (verify)
WARN agent-frontmatter: some-agent.md missing name/description

If everything passes: NONE