security-audit

Security Audit

Comprehensive security audit of your project AND Claude Code configuration. Analyzes secrets exposure, injection surfaces, dependencies, hook security, and produces a scored security posture assessment.

Time: 2-5 minutes | Scope: Full project + Claude Code config

For a quick config-only check, use /security-check instead.

Instructions

You are a senior application security engineer. Perform a 6-phase security audit and produce a scored report with prioritized remediation plan.

---

Pre-Step: Establish Audit Context

Before running any checks, use AskUserQuestion to ask:

1. Environment: Is this code running in production, staging, or local development?
2. Scope: Full audit or specific areas to prioritize?

This is critical for accurate findings:

• Local dev: DEBUG=True, CORS *, HTTP without TLS, .env files — all normal. Do NOT flag as vulnerabilities. Mention in an "Before going to production" informational section instead.
• Staging: Configs should mirror production. Flag deviations as MEDIUM.
• Production: Any misconfiguration is a real finding with full severity.

If the user doesn't answer or is unsure, default to production (conservative).

---

Phase 1: Configuration Security (via /security-check)

Execute all checks from /security-check (the examples/commands/security-check.md command). This covers:

• MCP server audit against CVE database
• Skills & agents against known malicious entries
• Hook exfiltration patterns
• Memory poisoning detection
• Permissions & settings review
• Exposed secrets in Claude Code config

Record findings — they contribute to the final score.

---

Phase 2: Project Secrets Scan

Scan the entire project for exposed secrets and credentials:

# API keys and tokens
grep -rn --include="*.{js,ts,py,go,java,rb,php,yaml,yml,json,toml,env,cfg,ini,conf}" \
  -E '(?i)(api[_-]?key|apikey|secret|password|passwd|token|bearer|auth)\s*[=:]\s*["'\''"][^"'\'']{8,}["'\''"]\s' \
  --exclude-dir={node_modules,vendor,.git,dist,build,target,__pycache__,.venv} . 2>/dev/null | head -30

# Known provider key patterns
grep -rn -E 'sk-[a-zA-Z0-9]{20,}|sk-ant-[a-zA-Z0-9]{20,}|ghp_[a-zA-Z0-9]{36}|AKIA[A-Z0-9]{16}|xox[bps]-[a-zA-Z0-9\-]{20,}' \
  --exclude-dir={node_modules,vendor,.git,dist,build,target} . 2>/dev/null | head -20

# Private keys
grep -rn 'BEGIN.*PRIVATE KEY' --exclude-dir={node_modules,vendor,.git} . 2>/dev/null

# .env files that might be committed
find . -name ".env*" -not -path "*/node_modules/*" -not -path "*/.git/*" -type f 2>/dev/null

# Check .gitignore coverage
[ -f ".gitignore" ] && {
  grep -q "\.env" .gitignore && echo "✅ .env in .gitignore" || echo "⚠️ .env NOT in .gitignore"
  grep -q "\.pem" .gitignore && echo "✅ .pem in .gitignore" || echo "⚠️ .pem NOT in .gitignore"
  grep -q "\.key" .gitignore && echo "✅ .key in .gitignore" || echo "⚠️ .key NOT in .gitignore"
}