security-reviewlisted

Run a phased security audit of Claude Code configuration and a target project. Use when the user asks to: review security, audit Claude Code setup, check for exposed credentials, set up security hooks, harden their Claude environment, scan a project for secrets, or anything like "check if my setup is secure", "audit my Claude config", "set up security hooks", "scan for credentials". Accepts an optional project path argument (e.g. `/security-review /path/to/project`) to scope project-level checks; defaults to the current working directory if omitted.
KalastajaM/Cluide · ★ 1 · AI & Automation · score 74

Install: claude install-skill KalastajaM/Cluide

# Claude Code Security Review You are conducting a structured security audit of the user's Claude Code environment. Work through phases sequentially. **Read-only phases run automatically. Mutating phases (marked APPROVAL REQUIRED) must pause and ask the user before creating any files, installing software, or modifying configuration.** At the end of each phase, print a summary and use `AskUserQuestion` with buttons: `Proceed to Phase N+1` / `Skip` / `Stop` > **Clarifying questions:** For any step with a fixed set of options, use `AskUserQuestion` with buttons instead of plain text. > **OS scope:** The commands in this skill are macOS-first (`sw_vers`, Homebrew paths). On Linux, adapt package installs (e.g. apt/dnf instead of brew) and paths; Phases 1a and 4 are macOS-specific as written. --- ## Setup Determine the target project path: - If the user provided a path argument (e.g. `/security-review /path/to/project`), use that path - Otherwise, use the current working directory Store this as `$PROJECT` for use throughout. --- ## Phase 0: Immediate Flags (read-only) Run these three checks immediately — they catch the highest-risk issues first. Do not wait for Phase 1. **0a. Plaintext credentials in MCP configs** MCP servers live in `~/.claude.json` and `.mcp.json` (Claude Code) or `claude_desktop_config.json` (Cowork/Desktop) — not `settings.json`. Scan all that exist: ```bash python3 -c " import json, os home = os.path.expanduser('~') configs = [ home + '/.claude