Security Scan

Audit Claude Code configuration for security issues using AgentShield.

When to Activate

• Setting up a new Claude Code project
• After modifying settings.json, CLAUDE.md, or MCP configs
• Before committing configuration changes
• Onboarding to repo with existing configs
• Periodic security hygiene checks

What It Scans

• CLAUDE.md — Hardcoded secrets, auto-run instructions, injection patterns
• settings.json — Overly permissive allow lists, missing deny lists
• mcp.json — Risky MCP servers, hardcoded env secrets
• hooks/ — Command injection via interpolation, data exfiltration
• agents/ — Unrestricted tool access, missing model specs