review-security

.claude/ Security Review Protocol

Audits security posture of the Claude Code configuration layer. Scope is deliberately narrow: .claude/ files + settings. Does NOT review app code (that's what /security-review is for).

Part of the review-* skill family. Cites ../_shared/review-checklist.md.

Owner: docs-manager (once registered) or general-purpose fallback. Coordinate with code-reviewer for findings that require pattern validation.

When to invoke

• After adding new MCP servers or hooks
• When granting a new agent broad tool permissions
• Periodic audit (quarterly or after any security-relevant incident)
• Before sharing the project with new teammates
• After modifying settings.json / settings.local.json

Output contract

Board tasks only. Lean summary to main agent.

---

Step 1 — Secret scanning in .claude/

Grep recursively under .claude/ for high-signal secret patterns:

• sk-[a-zA-Z0-9]{20,} — Anthropic/OpenAI style keys
• AIza[0-9A-Za-z_-]{35} — Google API keys
• AKIA[0-9A-Z]{16} — AWS access keys
• ghp_[a-zA-Z0-9]{36} — GitHub tokens
• xox[baprs]-[a-zA-Z0-9-]+ — Slack tokens
• -----BEGIN (RSA )?PRIVATE KEY----- — private keys
• postgres://[^:]+:[^@]+@ — Postgres connection strings with embedded passwords
• Any hardcoded password inside a hook script

Severity: critical if found. Immediately flag and recommend: (1) rotate the secret, (2) move to Secret Manager or env vars, (3) scrub git history if committed.

Scan locations:

• .claude/agents/*.md
• .claude/skills/**/*.md
• .claude/rules/*.md
• .claude/hooks/*.sh
• .claude/settings.json (should reference env vars, never contain secrets)
• .claude/settings.local.json

Step 2 — Permission audit: settings.json / settings.local.json

Read both files. For each, evaluate:

Allow list red flags:

• Bash(*) — inherently broad; safe ONLY with a robust deny list (verify)
• Edit(**) — allows writing anywhere (Edit rules cover every file-editing tool: Edit, Write, NotebookEdit); flag high unless intentional. A Write(**) or NotebookEdit(**) entry is inert and only produces a startup warning — flag it for removal
• WebFetch(*) — can exfiltrate; low risk on trusted machines but flag for awareness
• mcp__*__* — per-server wildcards; verify MCP server isn't high-risk
• Tool grants without qualifiers on specific tools (e.g., Bash without (...) = everything)