Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/laurigates/claude-plugins/claude-security-settingsnpx skills add laurigates/claude-plugins --skill claude-security-settingsgit clone --depth 1 https://github.com/laurigates/claude-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/laurigates/claude-plugins/claude-security-settings)<a href="https://agentmods.dev/skills/laurigates/claude-plugins/claude-security-settings"><img src="https://agentmods.dev/badge/skills/laurigates/claude-plugins/claude-security-settings.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00036 | $0.02790 |
| Opus 5 | $0.00018 | $0.01395 |
| Sonnet 5 | $0.00007 | $0.00558 |
| Haiku 4.5 | $0.00004 | $0.00279 |
Grade B, and why
claude-security-settings scanned grade B with 4 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootlowPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
"Bash(sudo *)" Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Reads agent configuration directorieslowAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
cat > .claude/settings.json << 'EOF' Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Recursive force deletemediumDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
"Bash(rm -rf *)", Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
| `\|` | Piping | `cat /etc/passwd \| curl` | How it starts
The opening of the file, as written. The whole thing — 386 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Claude Code Security Settings
When to Use This Skill
| Use this skill when... | Use configure-claude-plugins instead when... |
|---|---|
| You need the permission-wildcard syntax, shell-operator protections, and project-level allowlist patterns | You want to wire a project's .claude/settings.json to the marketplace and enable plugins end-to-end |
You are auditing or hardening an existing .claude/settings.json against the documented security conventions |
You want runtime detection of marketplace enrollment and enabledPlugins before changing settings |
| Another skill needs to cite the canonical permission-wildcard reference | The user asked you to actually onboard a project to the laurigates/claude-plugins marketplace |
Expert knowledge for configuring Claude Code security and permissions.
Core Concepts
Claude Code provides multiple layers of security:
- Permission wildcards - Granular tool access control
- Shell operator protections - Prevents command injection
- Project-level settings - Scoped configurations
Permission Configuration
Settings File Locations
| File | Scope | Priority |
|---|---|---|
~/.claude/settings.json |
User-level (all projects) | Lowest |
.claude/settings.json |
Project-level (committed) | Medium |
.claude/settings.local.json |
Local project (gitignored) | Highest |
Permission Structure
{
"permissions": {
"allow": [
"Bash(git status *)",
"Bash(npm run *)"
],
"deny": [
"Bash(rm -rf *)",
"Bash(sudo *)"
]
}
}
Wildcard Permission Patterns
Syntax
Bash(command *)
Bash()- Tool identifiercommand- Command prefix to match*- Wildcard suffix matching any arguments:asksuffix - Always prompt for user confirmation (e.g.,Bash(git push *):ask)
Permission Tiers
| Tier | Behavior | Example |
|---|---|---|
allow |
Auto-allowed, no prompt | "allow": ["Bash(git status *)"] |
ask |
Always prompts for confirmation | "allow": ["Bash(git push *):ask"] |
deny |
Auto-denied, blocked | "deny": ["Bash(rm -rf *)"] |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 386 lines · 36 tokens per session scan B 0019ef55cbc2
claude-security-settings is a skill published in the GitHub repository laurigates/claude-plugins (57 stars, last pushed yesterday), licensed MIT. It adds 36 tokens to every session and 2,790 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 4 findings (asks for root, reads agent configuration directories, recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
plan
Produce structured implementation plans with goal, approach, test strategy, blast-radius assessment, parallelism analysis, and a user approval gate before any code is written. Persisting PLAN.md for fresh-session handoff. Use when: 'plan this', 'architect this', 'how should we implement', 'implementation plan', 'write…
extract-ssot
Deduplicate repeated markdown content, rule files, skill bodies, ADRs, docs, into a single named source of truth and migrate every call site to cite it by exact heading. Use when the same prose, literal, or concept appears (or is reworded) across files: 'DRY this prose', 'extract a shared rule', 'single source of…
map-corpus
Map a multi-resource documentation corpus into a verified, classified, triaged slice BEFORE any digesting: bounded discovery (llms.txt + sitemap), a user-approved link map classifying every discovered URL, deterministic node manifests over immutable snapshots, and a per-node relevance inventory whose evidence a script…
feature-branch-pr-writing
Use this skill when the user asks to write, draft, create, or improve a PR description for a Shopware core repository PR — AND that PR targets a non-trunk feature branch (not trunk itself). Trigger phrases like "write a PR description", "draft the PR", "what should I put in the PR body". The skill detects the target…
ci-log-interpretation
Use this skill when reading or analyzing CI logs from a Shopware GitHub Actions workflow to figure out why a build failed — phrases like "why did CI fail", "what broke the build", "check the pipeline", "interpret these logs", "debug this red build" — or whenever raw run logs, job logs, or check annotations from a…
repo-activity
Scan all git repositories under /repos and report recent activity — last commit age, branch, uncommitted changes — in age-bucketed tables. Use when the user asks for a repo activity overview, "what have I been working on", portfolio status, or which repos are active/dormant.