settings-security-audit

name	settings-security-audit
description	Audit Claude Code settings.json for security vulnerabilities — detect allow-bypasses-deny, missing sensitive file denies, and overly broad permissions. Use after any settings.json change.
version	1.0.0
user-invocable	true
model	sonnet
tools	["Read","Glob","Grep","Bash"]

Settings Security Audit

Overview

Audit all Claude Code settings files for security vulnerabilities. Born from a real incident: Bash(cat:*) in allow rules silently bypassed Read deny rules for weeks.

Core principle: An allow rule that can replicate a denied tool's functionality is a security hole, not a feature.

Process

Step 1: Collect Settings Files

Read all settings files that exist (skip missing ones silently):

File	Scope
~/.claude/settings.json	Global settings
~/.claude/settings.local.json	Global local override
.claude/settings.json	Project settings (cwd)
.claude/settings.local.json	Project local override

Parse each file's permissions object, which contains allow and deny arrays.

Step 2: Check Allow-Bypasses-Deny (CRITICAL)

This is the highest priority check. For each deny rule, verify no allow rule can bypass it.

Bypass mapping — if deny blocks the left column, allow must not contain the right column:

Denied Tool	Bypassed By (in allow)
Read	Bash(cat:*), Bash(head:*), Bash(tail:*), Bash(less:*), Bash(more:*), Bash(bat:*)
Edit	Bash(sed:*), Bash(awk:*), Bash(perl:*), Bash(tee:*)
Write	Bash(tee:*), Bash(cp:*), Bash(mv:*)
Grep	Bash(grep:*), Bash(rg:*), Bash(ag:*)
Glob	Bash(find:*), Bash(fd:*), Bash(ls:*)
WebFetch	Bash(curl:*), Bash(wget:*)

Also check: if any deny rule targets a specific path pattern (e.g., Read(~/.env)), check if Bash(cat:*) or similar broad allow exists.

Partial match logic: Bash(cat:*) bypasses ANY Read deny. Bash(cat:/specific/path) only bypasses Read deny for that path.

Step 3: Check Overly Broad Allows (WARNING)

Flag these patterns:

Pattern	Risk
Bash(*)	Unrestricted shell — bypasses everything
Bash(rm:*)	Can delete any file
Bash(chmod:*)	Can change permissions
Bash(chown:*)	Can change ownership
Bash(sudo:*)	Privilege escalation
Bash(eval:*)	Arbitrary code execution
Bash(sh:*), Bash(bash:*)	Sub-shell spawning

Step 4: Check Missing Sensitive File Denies (WARNING)

The deny list should cover these patterns. Report any missing:

.env
.env.*
*credentials*
*secret*
*.pem
*.key
id_rsa
id_ed25519
*mnemonic*
*seed*
*-cookies
.obsidian/workspace*.json

Check both Read and Bash(cat:...) deny coverage.

Step 5: Check Hooks Configuration (INFO)

For each hook in hooks object:

• Empty matcher: Hook with empty matching_tool_names array and no event filter fires on everything (probably unintended overhead)
• Dead hook: Hook referencing a tool that isn't in allow list
• Redundant hooks: Multiple hooks with identical matchers

Step 6: Cross-File Conflicts (INFO)

When multiple settings files exist:

• Local overrides that weaken global denies (local allow contradicts global deny)
• Project settings that are more permissive than global settings

Report Format

Output as structured markdown:

# Settings Security Audit Report

**Files analyzed:** [list]
**Date:** YYYY-MM-DD

## CRITICAL (action required)

- [ ] `Bash(cat:*)` in allow bypasses `Read` deny — remove from allow or add `Bash(cat:...)` to deny
  - File: `~/.claude/settings.json`
  - Allow rule: `Bash(cat:*)`
  - Bypassed deny: `Read(~/.env)`

## WARNING (recommended)

- [ ] Missing deny for `.env` files
- [ ] Overly broad: `Bash(rm:*)` in allow

## INFO

- Hooks: 3 configured, 0 empty matchers
- Cross-file: no conflicts detected

## PASS

- No allow-bypasses-deny for Edit tool
- Sensitive key files (.pem, .key) covered in deny
- No overly broad Bash allows

Rules

1. CRITICAL findings = non-zero exit. If any CRITICAL found, end with "ACTION REQUIRED" and list exact fixes.
2. Don't auto-fix. Report only. User decides what to change.
3. Be specific. Every finding must include: which file, which rule, what it bypasses.
4. Check all scopes. Global + project settings interact. A project allow can bypass a global deny.
5. No false positives on intentional patterns. Bash(git:*) is normal. Only flag bypass patterns from the mapping above.