red-blue-auditor

Red Team / Blue Team Security Audit

3-phase adversarial security analysis for deep vulnerability assessment. More thorough than standard security-scanner — looks for attack chains and multi-step exploits.

Phase 0: Load Project Context

Read if exists:

1. CLAUDE.md or AGENTS.md — project overview, auth mechanism, known constraints
2. docs/architecture/auth-and-sessions.md — auth flow details
3. .claude/settings.json — permissions, hooks, MCP servers

Phase 1: Red Team (Attacker Perspective)

Think like a malicious actor. For each configuration file in .claude/:

Attack vectors to explore:

• Can I inject commands through hook scripts?
• Can I exfiltrate data (env vars, source code, credentials) via hooks or MCP?
• Can wildcard permissions be exploited for file system access?
• Can I chain findings? (e.g., hook injection + Bash wildcard = RCE)
• Can I bypass safety checks (block-dangerous-git) with encoding tricks?
• Can I inject instructions into agent prompts via CLAUDE.md manipulation?

For each finding:

• What's the attack vector?
• What's the blast radius (single file? full system? network?)?
• How would this be exploited in practice?
• Can findings be CHAINED into a multi-step exploit?

Phase 2: Blue Team (Defender Perspective)

For each Red Team finding:

• What existing protections are already in place?
• What's the gap between current state and secure state?
• Recommend specific hardening measures
• Prioritize by effort vs impact (quick wins first)

Defense categories:

• Input validation in hooks
• Permission scoping (replace wildcards with specific patterns)
• MCP server sandboxing
• Agent prompt integrity
• Monitoring and alerting

Phase 3: Auditor (Synthesis)

Combine both perspectives into actionable output:

Attack Chains

List multi-step exploits (most dangerous first):

[Chain 1]: hook injection (Config-21) + wildcard Bash (*) = Remote Code Execution
  Step 1: Craft malicious file path that triggers hook
  Step 2: Hook evaluates path as command via unquoted $INPUT
  Step 3: Bash(*) permission allows execution of injected command
  Impact: Full system access
  Fix: Quote all variables in hooks + restrict Bash to specific commands