binay-pybinay-py/claude-skills/skills/claude-safety-audit/SKILL.md

claude-safety-audit

Skill1 starsChanged 6 days agoMITView on GitHub

Audit a Claude Code setup for the risks that cause leaked keys and wiped machines. Finds secrets saved into permission rules by "Yes, and don't ask again", .claude/settings.local.json or .mcp.json committed to git or still in git history, over-broad allow rules (Bash(*), rm, sudo, git push incl. --force, curl | sh), bypassPermissions mode, and missing deny rules. Can fix them with backups. Use when the user asks if their Claude Code setup is safe, after a scare, before open-sourcing a repo, or when setting up a new machine.

Pipes a download into a shell
Reads credentials
Deletes or force-pushes
Commits and pushes

In this repository25 other files it gives its agents.
- bash-checkpointSkill
- brave-cdpSkill
- cf-backupSkill
- cf-pages-deploySkill
- claude-md-doctorSkill
- claude-sandboxSkill
- claude-token-auditSkill
- cws-extension-checkSkill
- env-doctorSkill
- event-recap-videoSkill
- freelance-proposalSkill
- gif-makerSkill
- itch-html5-packageSkill
- link-preview-checkSkill
- mcp-auditSkill
- package-guardSkill
- pwa-checkSkill
- read-guardSkill
- readme-upgradeSkill
- release-notesSkill
- secret-commit-guardSkill
- session-handoffSkill
- site-qaSkill
- thumbnail-makerSkill
- visual-diffSkill

The file

We split this skill into the rules it gives an agent

3 rules. About 0 are common, 1 is distinctive, and 2 are very specific to this project.

≈0
Common · estimate
Many files like this have a rule of this kind.
≈1
Distinctive · estimate
This author's own choices. Worth a look.
2
Very specific
Tied to their project's names, files or tools. Probably skip.

Common
Distinctive
Very specific

Distinctive:
Remove allow rules that contain secrets (Claude will ask again next time, which is the point).
line 27
Very specific:
Add .claude/settings.local.json to .gitignore, and git rm --cached it if tracked (the local file stays).
line 29
Very specific:
Ask before --apply on settings the user cares about.
line 34

≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.

Files

SKILL.md

claude-safety-audit

scripts/audit.mjs is zero-dependency Node 22+. It is read-only unless --apply is passed, and it never prints a full secret (only the first 6 characters).

node audit.mjs                          # ~/.claude + every git repo under the current folder (depth 4)
node audit.mjs --root ~/code --root ~/work
node audit.mjs --fix                    # preview fixes
node audit.mjs --fix --apply            # apply them (every touched file is backed up as *.bak-<timestamp>; files inside a git repo are backed up to ~/.claude/backups/ so the copy can't be committed)

What it checks

Severity	Finding
high	A token, key, password, JWT or credentialed URL inside a `permissions.allow` rule. "Yes, and don't ask again" saves the exact command, secrets included.
high	`settings.local.json` / `.mcp.json` with a secret that git tracks.
high	`Bash()`, `sudo`, `git push:` or `git:*` (which include `--force`), `curl … \| sh`, disk tools; `defaultMode: bypassPermissions`; home or root in `additionalDirectories`.
medium	Secret files present in git history, not in `.gitignore`, `rm`/`Remove-Item` allowed, no deny rules.
low/info	The bypass-mode warning hidden, no PreToolUse safety hook, keys in `~/.claude.json`.

Fixes it can apply

Remove allow rules that contain secrets (Claude will ask again next time, which is the point).
Add deny rules for catastrophic commands to ~/.claude/settings.json: rm -rf ~ and /, git push --force, git reset --hard, git clean -fdx, mkfs, dd, diskpart, plus Read(.env) / Read(.env.*) (bare names match at any depth), ~/.ssh and ~/.aws. Per the Claude Code permissions docs, :* and a trailing * are equivalent, and deny rules apply to every part of a compound command. But Bash rules are not a security boundary (sh -c or a full path gets around them), which is why bash-checkpoint exists.
Add .claude/settings.local.json to .gitignore, and git rm --cached it if tracked (the local file stays).

What you must tell the user

A secret that was ever committed and pushed is compromised. Removing it from the repo does not help: rotate the key at the provider first, then clean history if they want (git filter-repo / BFG).
Deny rules are prefix matches and are a safety net, not a sandbox. Pair them with the bash-checkpoint hook (snapshots before destructive commands) and, for risky work, a container.
Ask before --apply on settings the user cares about. Show the --fix preview first.

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

It worked
Partly
It didn't

What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free