Config Security Scan Skill for Claude
Scan .claude/ directory for security misconfigurations, exposed secrets, unsafe permissions
Install
one command, takes just this skill from the repositorynpx skills add https://github.com/vibeeval/vibecosystem --skill config-security-scanWhat it tells the agent to use
found in the instruction textThe instruction itself
13 sections, as written by the authorConfig Security Scan
Scan your .claude/ directory and related configuration files for security issues. Inspired by AgentShield pattern - checks CLAUDE.md, settings.json, MCP configs, hooks, and agent definitions for misconfigurations, exposed secrets, and unsafe permissions.
Usage
/config-security-scan [path]
Default path: .claude/ in current project.
What It Checks
1. Secrets Detection (CRITICAL)
- API keys, tokens, passwords in CLAUDE.md
- Hardcoded credentials in hook scripts
- Secrets in MCP server configs
- Bearer tokens in agent definitions
- .env files committed to git
2. Permission Escalation (HIGH)
- dangerouslySkipPermissions in settings.json
- Overly broad tool permissions (all tools for simple agents)
- MCP servers with filesystem write access
- Hooks with shell execution and no validation
- Agents with Bash tool that don't need it
3. MCP Server Security (HIGH)
- Unknown/untrusted MCP servers
- MCP servers with network access + filesystem access
- Missing authentication on MCP endpoints
- MCP servers running as root/admin
- Unverified npm packages in MCP configs
4. Hook Security (MEDIUM)
- Hooks that execute user input
- Hooks without error handling
- Hooks that modify git config
- Hooks that access external networks
- Hooks with hardcoded paths
5. Agent Definition Security (MEDIUM)
- Agents with unnecessary tools
- Agents with system-level Bash access
- Agent descriptions that could enable prompt injection
- Agents without clear scope boundaries
6. Configuration Hygiene (LOW)
- Unused MCP server configs
- Deprecated settings
- Conflicting rules
- Missing recommended security settings
Scan Procedure
# Step 1: Find all config files
find .claude/ -type f \( -name "*.json" -o -name "*.md" -o -name "*.yml" -o -name "*.yaml" -o -name "*.js" -o -name "*.mjs" -o -name "*.ts" \)
# Step 2: Secret patterns
grep -rn "api[_-]?key\|password\|secret\|token\|bearer\|sk-\|pk_\|ghp_\|gho_\|xoxb-\|xoxp-" .claude/
# Step 3: Permission checks
grep -rn "dangerouslySkipPermissions\|allowedTools.*Bash\|shell_exec\|eval(" .claude/
# Step 4: MCP config review
cat .mcp.json 2>/dev/null | jq '.mcpServers | keys'
# Step 5: Hook review
ls .claude/hooks/ 2>/dev/null
Output Format
# Config Security Scan Report
Scanned: [path]
Date: [timestamp]
## Summary
- CRITICAL: X issues
- HIGH: Y issues
- MEDIUM: Z issues
- LOW: W issues
## CRITICAL Issues
### [Issue Title]
**File:** [path]
**Line:** [number]
**Issue:** [description]
**Fix:** [remediation]
## Recommendations
1. [Action item]
Hard Exclusion List (Skip These)
These are NOT security issues in the .claude/ context:
- Environment variable references (not actual values)
- Test/example credentials clearly marked as such
- Public API keys meant to be public
- SHA hashes used as identifiers
- Base64-encoded non-secret data
- localhost/127.0.0.1 URLs
Integration
- security-reviewer: Calls this skill during security audits
- verifier: Includes config scan in pre-commit checks
- shipper: Runs before deployments
Other skills for the same job
different authors, same section of the catalogue
Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.
This skill should be used when the user asks to "perform cloud penetration testing", "assess Azure or AWS or GCP security", "enumerate cloud resources", "exploit cloud misconfigurations", "test O365 security", "extract secrets from cloud environments", or "audit cloud infrastructure". It provides comprehensive techniques for security assessment across major cloud platforms.
You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.
Comprehensive Flow Nexus platform management - authentication, sandboxes, app deployment, payments, and challenges
This skill should be used when the user asks to "escalate privileges on Linux", "find privesc vectors on Linux systems", "exploit sudo misconfigurations", "abuse SUID binaries", "exploit cron jobs for root access", "enumerate Linux systems for privilege escalation", or "gain root access from low-privilege shell". It provides comprehensive techniques for identifying and exploiting privilege escalation paths on Linux systems.
Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral analysis, and malware family identification. Handles static/dynamic analysis, unpacking, and IOC extraction. Use PROACTIVELY for malware triage, threat hunting, incident response, or security research.
This skill should be used when the user asks to "use Metasploit for penetration testing", "exploit vulnerabilities with msfconsole", "create payloads with msfvenom", "perform post-exploitation", "use auxiliary modules for scanning", or "develop custom exploits". It provides comprehensive guidance for leveraging the Metasploit Framework in security assessments.
Expert in secure mobile coding practices specializing in input validation, WebView security, and mobile-specific security patterns. Use PROACTIVELY for mobile security implementations or mobile security code reviews.
How to use it
Take vibeeval/config-security-scan from the repository into ~/.claude/skills for personal
use, or into .claude/skills inside a project.
The agent identifies a skill by the name field in its header. Two skills with the
same name cannot sit side by side — one of them will be ignored.