config-security-scan
Scan .claude/ directory for security misconfigurations, exposed secrets, unsafe permissions
npx skills add vibeeval/vibecosystem --skill config-security-scan --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Config Security Scan Scan your `.claude/` directory and related configuration files for security issues. Inspired by AgentShield pattern - checks CLAUDE.md, settings.json, MCP configs, hooks, and agent definitions for misconfigurations, exposed secrets, and unsafe permissions. ## Usage ``` /config-security-scan [path] ``` Default path: `.claude/` in current project. ## What It Checks ### 1. Secrets Detection (CRITICAL) ``` - API keys, tokens, passwords in CLAUDE.md - Hardcoded credentials in hook scripts - Secrets in MCP server configs - Bearer tokens in agent definitions - .env files committed to git ``` ### 2. Permission Escalation (HIGH) ``` - dangerouslySkipPermissions in settings.json - Overly broad tool permissions (all tools for simple agents) - MCP servers with filesystem write access - Hooks with shell execution and no validation - Agents with Bash tool that don't need it ``` ### 3. MCP Server Security (HIGH) ``` - Unknown/untrusted MCP servers - MCP servers with network access + filesystem access - Missing authentication on MCP endpoints - MCP servers running as root/admin - Unverified npm packages in MCP configs ``` ### 4. Hook Security (MEDIUM) ``` - Hooks that execut
- Usage
- What It Checks
- 1. Secrets Detection (CRITICAL)
- 2. Permission Escalation (HIGH)
- 3. MCP Server Security (HIGH)
- 4. Hook Security (MEDIUM)
- 5. Agent Definition Security (MEDIUM)
- 6. Configuration Hygiene (LOW)
- Scan Procedure
- Output Format
- Hard Exclusion List (Skip These)
- Integration
Step 1: Find all config files
find .claude/ -type f \( -name "*.json" -o -name "*.md" -o -name "*.yml" -o -name "*.yaml" -o -name "*.js" -o -name "*.mjs" -o -name "*.ts" \)
Step 2: Secret patterns
grep -rn "api[_-]?key\|password\|secret\|token\|bearer\|sk-\|pk_\|ghp_\|gho_\|xoxb-\|xoxp-" .claude/
Step 3: Permission checks
grep -rn "dangerouslySkipPermissions\|allowedTools.*Bash\|shell_exec\|eval(" .claude/
Step 4: MCP config review
cat .mcp.json 2>/dev/null | jq '.mcpServers | keys'
Step 5: Hook review
ls .claude/hooks/ 2>/dev/nullWhat does the config-security-scan skill do?
Scan .claude/ directory for security misconfigurations, exposed secrets, unsafe permissions
How do I install it?
Run `npx skills add vibeeval/vibecosystem --skill config-security-scan --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From vibeeval/vibecosystem, a repository with 521 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.