Loading...
Loading...
Found 13 Skills
Scan your Claude Code configuration (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions.
Audits Claude Code setup across CLAUDE.md, rules, skills, hooks, and MCP. Run when Claude ignores rules, hooks malfunction, or MCP needs auditing. Not for debugging code or reviewing PRs.
Audit OpenCode configuration quality, safety, and operability with a 100-point rubric and concrete remediations.
Audit Claude Code configuration health across all layers (CLAUDE.md, rules, skills, hooks, MCP). Run periodically or when collaboration feels off.
Deep diagnostic of Claude/SDD configuration. Read-only. Produces audit-report.md consumed by /project-fix. Trigger: /project-audit, audit project, review claude config, project health check.
Run ScoutSuite for multi-cloud security auditing. Collects configuration data from AWS, Azure, GCP, Oracle, and Alibaba Cloud and generates an interactive security report.
Validate Biome 2.3+ configuration and detect outdated patterns. Ensures proper schema version, domains, assists, and recommended rules. Use before any linting work or when auditing existing projects.
Show infrastructure standards compliance status (read-only)
Audit MCP (Model Context Protocol) server configurations for security issues. Use this skill when: - Reviewing .mcp.json files for security risks - Checking MCP server args for hardcoded secrets or shell injection patterns - Validating that MCP servers use pinned versions (not @latest) - Detecting unpinned dependencies in MCP server configurations - Auditing which MCP servers a project registers and whether they're on an approved list - Checking for environment variable usage vs. hardcoded credentials in MCP configs - Any request like "is my MCP config secure?", "audit my MCP servers", or "check .mcp.json" keywords: [mcp, security, audit, secrets, shell-injection, supply-chain, governance]
Identify error-prone APIs and dangerous configurations
Statically review MCP configuration for mutable package references before approval or CI, without executing discovered MCP servers. Use when reviewing .mcp.json, Cursor, VS Code, Claude, Windsurf, or other repo-scoped MCP config.
Use when a site must be cleaned of development, staging, and test artifacts before going live: localhost and staging URLs, preview hostnames, test data and accounts, debug routes, source maps, console noise, placeholder environment values, and mismatches between build modes. It finds them in source, config, and shipped output and repairs the safe ones. Do not use it for penetration testing, for deployment itself, or to modify production infrastructure or environment values.