"Bash(python3:*)" in a committed .claude/settings.json lets any text Claude reads get code run on your teammates' machines without a prompt, and a SessionStart hook with curl | bash runs a remote script every time someone opens the project. This skill finds those and ten other Claude Code settings mistakes before you commit or trust the settings, and tells you how to fix each one.

Your agent runs a scanner on .claude/settings.json and .claude/settings.local.json in each project folder, on ~/.claude/settings.json when you point it there, and on managed-settings.json files. It follows Claude Code's own rule syntax: Bash(npm run ) and Bash(npm run:) are the same prefix rule, //path is absolute while /path stays inside the project, only Read and Edit rules match paths, and an allow rule of * approves nothing. It reads hook commands and HTTP hooks, helper commands such as apiKeyHelper, and sandbox settings, and lists the .env files beside each .claude folder. It never runs Claude Code, hooks or MCP servers. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• CC01: defaultMode set to bypassPermissions

• CC02: allow rules that approve any command (Bash, Bash(*), Bash(python:*), Bash(npx ), Bash(git ))

• CC03: curl, wget, scp, ssh, gh api or gh gist create allowed with any arguments

• CC04: keys and tokens in env, apiKeyHelper, hook commands or HTTP hook headers

REVIEW (check before release)

• CC11: hooks that download and run code or send data to outside servers

• CC12: hooks that eval their tool input or pipe it into a shell

• CC13: enableAllProjectMcpServers turned on

• CC14: file access to the whole disk, the home folder, ~/.ssh or .env files

• CC15: .env files that no Read deny rule covers

• CC16: WebFetch allowed for every domain

• CC17: sandbox escapes (Docker socket, all Unix sockets, weaker nested sandbox, broad excludedCommands or allowWrite)

• CC18: deny rules Claude Code never matches (Write(./.env), /etc/... with one slash)

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example project, and the real report the scanner produces on the risky one

Limits

It reads each settings file as written: settings it is not pointed at (user, managed, server-managed or --settings), hook scripts named by path, plugin hooks, .mcp.json servers and CLAUDE.md are not combined or read. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 18 files: SKILL.md, the scanner in scripts/ (3 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (12 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.