Help us improve
Share bugs, ideas, or general feedback.
From security-guardrails
Audit agent configuration files for security vulnerabilities and misconfigurations. Covers settings.json, .mcp.json, .codex/config.toml, AGENTS.md, hooks, plugin manifests, and relay config. Classify findings as P0 or P1.
How this skill is triggered — by the user, by Claude, or both
Slash command
/security-guardrails:agent-config-security-auditThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Systematic security review of agent configuration files. Run before committing config changes or onboarding a new repository.
Share bugs, ideas, or general feedback.
Systematic security review of agent configuration files. Run before committing config changes or onboarding a new repository.
.claude/settings.json, .claude/mcp.json, AGENTS.md, hooks)Audit every config file present:
| File | Agent |
|---|---|
.claude/settings.json | Claude Code |
.claude/mcp.json (or project-root mcp.json) | Claude Code |
.codex/config.toml | Codex |
docs/AGENTS.md (project root) | Generic/Codex |
docs/CLAUDE.md (project root) | Claude Code |
hooks/ | Any |
plugins/*/plugin.json | Agent Powerups |
.apx/relay/*.json | apx relay |
$ENV_VAR or process.env.* — never literal values.env and .env.local files are in .gitignoreenv fields contain variable references, not valuesP0 (block immediately): Hardcoded secret in any committed file.
allowedTools is scoped — no Bash(*) wildcard granting unrestricted shell accessdeniedTools list is present and non-empty for risky operations--no-verify, --force, or safety-bypass flags in hook commandsP0: Bash(*) or equivalent wildcard in allow list.
P1: No deniedTools list when Bash is in scope.
${file}, ${input}, or other user-interpolated variablescurl, wget) in hooks without explicit user knowledge2>/dev/null, || true)P0: Command injection via interpolation in any hook. P1: Silent error suppression on a security or quality hook.
npx -y without a pinned version or digestdescription fieldP1: Unpinned npx -y auto-install in MCP server config.
P1: Auto-run instruction with shell exec; unconditional safety override.
plugins/NAME/.codex-plugin/plugin.json) declares tool access scoped to its purposelatest.apx/relay/) are in .gitignore| Severity | Definition | Response |
|---|---|---|
| P0 | Can directly compromise security or leak secrets | Fix before any commit; do not push |
| P1 | Increases attack surface or weakens safety controls | Fix before merging; document exception if deferred |
| Note | Best practice not followed, no direct risk | Fix in follow-up; log as tech debt |
Agent Config Security Audit — <project>/<date>
P0 findings:
[P0] <file>:<line> — <description>
Fix: <what to change>
P1 findings:
[P1] <file>:<line> — <description>
Fix: <what to change>
Notes:
[Note] <file> — <description>
Summary: <N> P0, <N> P1, <N> Notes
If no findings: state "No findings." explicitly.
npx claudepluginhub yeaight7/agent-powerups --plugin security-guardrailsOrchestrates changing an existing working feature to new desired behavior by updating tests first, then implementation, with review and gated commit.