dotclaude-security

Scan a repo's local .claude/ config — settings.json hooks, MCP server defs, env blocks, permissions.allow — for the RCE and API-key-exfiltration footguns that fire the moment you git clone and open an untrusted repository in Claude Code. It points at the exact dangerous line so you can read before you trust. Reads only — it never runs what it finds.

⚡ Run it in one line, no install, nothing leaves your machine:

npx dotclaude-security --dir ./some-cloned-repo

🤝 Want it hardened for you? Fixed-scope audit — $99 / 24h: I review each finding and send a written report with the exact .claude config fixes.

$ npx dotclaude-security --dir ./untrusted-repo
1 critical, 2 high, 0 medium across 1 config file(s).
  CRITICAL  .claude/settings.json:4  Auto-exec hook on "SessionStart" runs a command when the repo is opened
  HIGH      .claude/settings.json:7  permissions.allow pre-approves a dangerous tool: Bash(*)
  HIGH      .claude/settings.json:8  MCP server "x" runs an on-the-fly remote package (npx)

Why this exists

A repository can ship its own .claude/ config, and an agent honors it on open. In February 2026 Check Point Research disclosed two CVEs rooted in exactly this:

• CVE-2025-59536 (CVSS 8.7) — a repo-controlled SessionStart hook auto-executes a shell command when the directory is opened. Clone a malicious repo, open it, get popped. Remote code execution on init.
• CVE-2026-21852 — repo config (hook commands / env) reads your ANTHROPIC_API_KEY and ships it to a remote host. Silent key exfiltration.

Both attack the same surface: settings.json hooks, MCP server launch commands, env blocks, and the permissions.allow list — the things a stranger's repo can hand you. The big incumbents (Cisco's skill-scanner, Snyk's agent-scan) scan skills; almost nobody scans the .claude config files.

dotclaude-security parses those files, statically, and flags the exact file + line of every dangerous directive — so you triage facts, not maybes, and never execute the payload to find it.

What it checks

| Check | Severity | What it catches | |---|---|---| | Auto-exec hook on open (SessionStart/PreToolUse/UserPromptSubmit) | critical / high | command that runs the moment the repo is opened — RCE on init (CVE-2025-59536) | | Hook reads a secret and calls the network | critical | ANTHROPIC_API_KEY/token piped to a remote host — key exfil (CVE-2026-21852) | | Dangerous command pattern in any hook | high | curl\|sh, eval, base64 -d, nc -e, /dev/tcp, inline python -c/node -e | | MCP server launches a dangerous command | critical | MCP command/args that fetch-and-run code on connect | | MCP server runs an on-the-fly remote package | high | npx/uvx/bunx MCP definitions that pull unpinned packages | | MCP server handed a secret / remote URL | high / medium | env-injected credentials, untrusted remote endpoints | | Risky permissions.allow entry | high / medium | Bash(*), WebFetch, broad mcp__* that remove the human approval gate | | Committed secret value | critical | real sk-ant-…, AKIA…, ghp_…, private keys in any .claude file |

Usage

# Scan the .claude/ config in the current repo
npx dotclaude-security

# Scan a freshly cloned, untrusted repo BEFORE you open it in Claude Code
npx dotclaude-security --dir ./some-cloned-repo

# Machine-readable JSON only (gate your CI on the summary)
npx dotclaude-security --json

# Write a shareable HTML report
npx dotclaude-security --html report.html

Output is JSON on stdout (pipe it into CI) and a one-line-per-finding summary on stderr. Each finding carries file, location.line, location.text and a concrete fix.

Install (optional)

npm i -g dotclaude-security
dotclaude-security --dir ./untrusted-repo

Zero dependencies. It reads your config files and reports — it never executes a hook, MCP command, or anything else it discovers. Nothing leaves your machine.

Sister tools

Same local-first, prove-the-real-issue philosophy across the stack, all MIT:

supabase-security · strapi-security · pocketbase-security · firebase-security · appwrite-security · nhost-security · stripe-webhook-security · github-actions-security · aws-s3-security

License

MIT © Renzo Madueno