Claude Security Audit

tdccccc4stars

A Claude Code skill that audits your configuration for malicious hooks, MCP servers, and suspicious commands

1# Claude Security Audit

README.mdMCP server

Transport: stdio
Status: Local

Power your agent

Add this server

Install from the publisher. Not a PlugMCP endpoint.

Run on PlugMCP

Host a copy with our keys and logs.

No packaged release in the registry yet. Follow the repository README.

RepositoryPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Local

Transport: stdio
License: MIT
Last checked: 2026-10-27

Stars: 4
Tools: —
Uptime: —

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

How do I install Claude Security Audit?

Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Claude Security Audit need an API key?

No required environment variable is listed on this record.

What transport does Claude Security Audit use?

Claude Security Audit runs locally over stdio.

When was Claude Security Audit last checked?

Last checked 2026-10-27. A Claude Code skill that audits your configuration for malicious hooks, MCP servers, and suspicious commands

From the publisher

Documentation

claude-security-audit

A Claude Code skill that audits your configuration for malicious hooks, MCP servers, and suspicious commands.

Why

Claude Code's hooks system can execute arbitrary commands silently. A malicious project or plugin could inject hooks that exfiltrate your SSH keys, credentials, or other sensitive data. This skill helps you detect such threats.

What it checks

Location	What
`~/.claude/settings.json`	hooks, MCP servers, dangerous settings
`~/.claude/skills/`	skill files for hidden commands
`~/.claude/plugins/`	plugin hooks
Project `.claude/`	project-level hooks and MCP configs
Project `CLAUDE.md`	instructions that bypass safety checks

Severity levels

CRITICAL — Active data exfiltration (e.g., curl + reading SSH keys)
HIGH — Dangerous commands or broad hooks
MEDIUM — Suspicious but needs human judgment
LOW — Informational

Install as Claude Code skill

# Copy to your skills directory
git clone https://github.com/tdccccc/claude-security-audit.git ~/.claude/skills/security-audit

Then use /security-audit in Claude Code, or just say "check my security".

Standalone usage

python3 scripts/scan.py                    # scan current directory
python3 scripts/scan.py /path/to/project   # scan specific project

License

MIT