security-scan

Security Scan

Run a comprehensive security scan of the Torus framework's gates, hooks, state files, and MCP tools.

Steps

1. Check all 17 gate files exist and export proper check() functions
2. Verify Gate 17 injection defense patterns are up to date
3. Scan MCP tool registrations for description mismatches
4. Check for hardcoded secrets in hooks/shared/*.py
5. Verify state files don't contain sensitive data
6. Check circuit breaker state for stuck-open gates
7. Audit .file_claims.json for stale claims
8. Report findings with severity levels

Usage

Use this skill to run a security audit of the framework before deploying changes or after adding new components.

Run python3 ~/.claude/skill-library/security-scan/scripts/scan.py for a programmatic scan report.

---

When to use

When the user says "security scan", "scan for vulnerabilities", "check security", "audit security", "security audit", "find security issues", or wants to review the framework for risks.

Commands

• /security-scan — Full security audit across all components
• /security-scan --component mcp|skills|hooks|agents — Scan a specific component only
• /security-scan --severity critical|high — Show only findings at or above severity level

---

Phase 1: INVENTORY — Catalog All Components

Read the following files to build the component inventory:

MCP Servers — from settings.json:

~/.claude/settings.json

Extract the mcpServers block. For each server record:

• Name, command, args, env vars (flag any with secrets/tokens in env)
• Transport type (stdio vs sse vs http)

Skills — glob all SKILL.md files:

~/.claude/skill-library/*/SKILL.md

For each skill record: name, trigger phrases, what commands it runs.

Hooks — from settings.json:

~/.claude/settings.json  →  hooks block

For each hook record: event type, matcher, command string.

Also read gate files:

~/.claude/hooks/gates/gate_*.py   (glob)

Agents — glob all agent definitions:

~/.claude/agents/*.md

For each agent record: name, tools list, any capability overrides.