Nobrainer Fast Audit

Safety First — Universal Security Diagnostics for Claude Code

Comprehensive security toolkit for any Claude Code environment. Detects supply chain attacks, audits skill/plugin integrity, checks OS hardening, monitors for indicators of compromise, and provides actionable hardening guidance based on the OWASP Agentic Top 10 (2026).

Works on macOS, Linux, Windows (via PowerShell), and VPS/server environments.

---

Commands

/safety-audit — Full System Security Audit

Runs all security checks appropriate for the detected platform: OS security posture, AI agent platform config, installed skills/plugins, credentials, network, and processes.

/safety-audit
/safety-audit quick    # Skip slow checks (network scan, full file audit)

/safety-check-skill — Pre-Installation Skill/Plugin Vetting

Analyzes a skill or plugin BEFORE installation for malicious patterns, supply chain risks, and OWASP ASI04 indicators.

/safety-check-skill /path/to/skill-directory
/safety-check-skill /path/to/plugin-directory

/safety-scan — Quick IOC Scan

Fast scan for known indicators of compromise (C2 connections, malware artifacts, unauthorized processes, memory poisoning).

/safety-scan

---

Execution Instructions

When any of the above commands is invoked, Claude Code should:

1. Detect the platform using uname -s (or $env:OS on Windows)
2. Run the appropriate checks from the sections below
3. Present results as a formatted security report with PASS/WARN/FAIL per category
4. Provide a summary with counts and any recommended actions

Use set -euo pipefail for all bash scripts. On Windows, use PowerShell equivalents. Commands that require elevated privileges should be noted but not skipped — report what couldn't be checked.

Important context for /safety-check-skill: When analyzing a security-focused skill (including this one), pattern matches inside regex variable assignments (e.g., PIPE_EXEC='curl.*\|.*sh'), documentation blocks, and detection rule definitions are not indicators of malicious intent — they are the detection signatures themselves. Score these as LOW (+3) with a note: "Pattern found in detection rule definition, not in executable context." Only flag matches that appear in actually executable code paths (outside of variable definitions and markdown code blocks that define grep patterns).

---

1. Cross-Platform Security Audit (/safety-audit)

Platform Detection

OS="$(uname -s 2>/dev/null || echo "Windows")"
case "$OS" in
    Darwin)  PLATFORM="macos" ;;
    Linux)   PLATFORM="linux" ;;
    MINGW*|MSYS*|CYGWIN*) PLATFORM="windows" ;;
    *)       PLATFORM="unknown" ;;
esac
echo "Detected platform: $PLATFORM"

If running inside a container or VM, note it. Check for /.dockerenv or /proc/1/cgroup containing "docker".

---

macOS Security Checks

Run these when PLATFORM=macos:

# System Integrity Protection
csrutil status 2>/dev/null | grep -q "enabled" && echo "[PASS] SIP enabled" || echo "[FAIL] SIP DISABLED"

# Gatekeeper
spctl --status 2>&1 | grep -q "assessments enabled" && echo "[PASS] Gatekeeper enabled" || echo "[FAIL] Gatekeeper DISABLED"

# FileVault
fdesetup status 2>/dev/null | grep -q "FileVault is On" && echo "[PASS] FileVault enabled" || echo "[WARN] FileVault OFF"

# Firewall
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate 2>/dev/null | grep -q "enabled" && echo "[PASS] Firewall enabled" || echo "[FAIL] Firewall DISABLED"

# XProtect freshness (warn if >14 days old)
XPROTECT_DB="/Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Resources/gk.db"
if [ -f "$XPROTECT_DB" ]; then
    XPROTECT_AGE=$(( ($(date +%s) - $(stat -f %m "$XPROTECT_DB")) / 86400 ))
    [ "$XPROTECT_AGE" -le 14 ] && echo "[PASS] XProtect updated ${XPROTECT_AGE}d ago" || echo "[WARN] XProtect ${XPROTECT_AGE}d old"
fi

# Launch Agents — flag unknown agents
for PLIST in ~/Library/LaunchAgents/*.plist; do
    [ -f "$PLIST" ] || continue
    PLIST_NAME=$(basename "$PLIST" .plist)
    # Flag if not from well-known vendors
    echo "$PLIST_NAME" | grep -qE '^(com\.apple|com\.google|com\.microsoft|homebrew|com\.docker|com\.jetbrains|com\.vscode)' || echo "[WARN] Unknown launch agent: $PLIST_NAME"
done

# Non-Apple launch daemons
ls /Library/LaunchDaemons/ 2>/dev/null | grep -v "com.apple" | while read -r d; do echo "[INFO] Non-Apple daemon: $d"; done

---

Linux Security Checks

Run these when PLATFORM=linux:

# SELinux
if command -v getenforce &>/dev/null; then
    STATUS=$(getenforce 2>/dev/null)
    [ "$STATUS" = "Enforcing" ] && echo "[PASS] SELinux enforcing" || echo "[WARN] SELinux: $STATUS"
fi

# AppArmor
if command -v aa-status &>/dev/null; then
    aa-status --enabled 2>/dev/null && echo "[PASS] AppArmor enabled" || echo "[WARN] AppArmor not enforcing"
fi

# UFW
if command -v ufw &>/dev/null; then
    ufw status 2>/dev/null | grep -q "Status: active" && echo "[PASS] UFW active" || echo "[FAIL] UFW inactive"
fi

# iptables fallback
if ! command -v ufw &>/dev/null && command -v iptables &>/dev/null; then
    RULES=$(iptables -L -n 2>/dev/null | wc -l)
    [ "$RULES" -gt 8 ] && echo "[PASS] iptables has rules" || echo "[WARN] iptables has minimal rules"
fi

# Disk encryption (LUKS)
if command -v lsblk &>/dev/null; then
    lsblk -o NAME,TYPE,FSTYPE 2>/dev/null | grep -q "crypto_LUKS" && echo "[PASS] LUKS encryption detected" || echo "[WARN] No LUKS encryption detected"
fi

# Unattended upgrades (Debian/Ubuntu)
if [ -f /etc/apt/apt.conf.d/20auto-upgrades ]; then
    grep -q 'Unattended-Upgrade "1"' /etc/apt/apt.conf.d/20auto-upgrades 2>/dev/null && echo "[PASS] Unattended upgrades enabled" || echo "[WARN] Unattended upgrades not configured"
fi

# Systemd services — flag recently added non-standard services
systemctl list-unit-files --state=enabled 2>/dev/null | grep -v -E '(systemd|dbus|ssh|cron|network|login|journal|udev|snapd|docker|containerd)' | while read -r svc _; do
    [ -n "$svc" ] && echo "[INFO] Enabled service: $svc"
done

---

Windows Security Checks (PowerShell)

Run these when PLATFORM=windows using powershell -Command:

# Windows Defender
$defender = Get-MpComputerStatus -ErrorAction SilentlyContinue
if ($defender) {
    if ($defender.RealTimeProtectionEnabled) { "[PASS] Defender real-time protection enabled" } else { "[FAIL] Defender real-time protection DISABLED" }
    if ($defender.AntivirusSignatureAge -le 7) { "[PASS] Defender signatures updated ($($defender.AntivirusSignatureAge)d ago)" } else { "[WARN] Defender signatures $($defender.AntivirusSignatureAge)d old" }
}

# UAC
$uac = (Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System).EnableLUA
if ($uac -eq 1) { "[PASS] UAC enabled" } else { "[FAIL] UAC DISABLED" }

# BitLocker
$bl = Get-BitLockerVolume -MountPoint "C:" -ErrorAction SilentlyContinue
if ($bl -and $bl.ProtectionStatus -eq "On") { "[PASS] BitLocker enabled on C:" } else { "[WARN] BitLocker not enabled on C:" }

# Windows Firewall
$fw = Get-NetFirewallProfile -ErrorAction SilentlyContinue
$fw | ForEach-Object { if ($_.Enabled) { "[PASS] Firewall $($_.Name) profile enabled" } else { "[FAIL] Firewall $($_.Name) profile DISABLED" } }

# SmartScreen
$ss = (Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" -ErrorAction SilentlyContinue).SmartScreenEnabled
if ($ss -eq "RequireAdmin" -or $ss -eq "Prompt") { "[PASS] SmartScreen enabled" } else { "[WARN] SmartScreen: $ss" }

---

VPS / Server Hardening Checks

Run these on Linux when SSH is the primary access method (detect via systemctl is-active sshd or process check):

# SSH hardening
SSHD_CONFIG="/etc/ssh/sshd_config"
if [ -f "$SSHD_CONFIG" ]; then
    grep -qi "^PermitRootLogin no" "$SSHD_CONFIG" && echo "[PASS] Root SSH login disabled" || echo "[FAIL] Root SSH login not explicitly disabled"
    grep -qi "^PasswordAuthentication no" "$SSHD_CONFIG" && echo "[PASS] SSH password auth disabled" || echo "[WARN] SSH password auth may be enabled"
    grep -qi "^PubkeyAuthentication yes" "$SSHD_CONFIG" && echo "[PASS] SSH pubkey auth enabled" || echo "[WARN] SSH pubkey auth not confirmed"
    grep -qi "^Port " "$SSHD_CONFIG" && echo "[INFO] SSH on non-default port: $(grep -i '^Port ' "$SSHD_CONFIG")" || echo "[INFO] SSH on default port 22"
fi

# fail2ban
if command -v fail2ban-client &>/dev/null; then
    fail2ban-client status 2>/dev/null | grep -q "Number of jail" && echo "[PASS] fail2ban running" || echo "[WARN] fail2ban installed but not running"
else
    echo "[WARN] fail2ban not installed"
fi

# Rootkit detection tools
command -v rkhunter &>/dev/null && echo "[PASS] rkhunter installed" || echo "[INFO] rkhunter not installed"
command -v chkrootkit &>/dev/null && echo "[PASS] chkrootkit installed" || echo "[INFO] chkrootkit not installed"

# Open ports (listening on all interfaces, not just localhost)
ss -tlnp 2>/dev/null | grep -v "127.0.0.1\|::1" | while read -r line; do
    echo "[INFO] External listener: $line"
done

---

2. AI Agent Platform Checks (Generic)

These checks apply to any AI agent platform (Claude Code, OpenClaw, LangChain agents, AutoGPT, etc.). Detect what's installed and check accordingly.

# ── Claude Code ──
CLAUDE_DIR="$HOME/.claude"
if [ -d "$CLAUDE_DIR" ]; then
    echo "── Claude Code Configuration ──"

    # Settings file
    SETTINGS="$CLAUDE_DIR/settings.json"
    if [ -f "$SETTINGS" ] && command -v jq &>/dev/null; then
        jq '.' "$SETTINGS" > /dev/null 2>&1 && echo "[PASS] settings.json valid JSON" || echo "[FAIL] settings.json invalid"
    fi

    # MCP servers in settings
    if [ -f "$SETTINGS" ]; then
        MCP_EXTERNAL=$(jq -r '.. | .mcpServers? // empty | to_entries[]? | select(.value.args? | tostring | test("bore\\.pub|ngrok|tunnel|proxy|cloudflared")) | .key' "$SETTINGS" 2>/dev/null || true)
        [ -n "$MCP_EXTERNAL" ] && echo "[FAIL] External MCP proxy in settings: $MCP_EXTERNAL" || echo "[PASS] No external MCP proxies in Claude Code settings"
    fi

    # Skills audit
    if [ -d "$CLAUDE_DIR/skills" ]; then
        SKILL_COUNT=$(find "$CLAUDE_DIR/skills" -name "SKILL.md" -type f 2>/dev/null | wc -l | tr -d ' ')
        echo "[INFO] Claude Code skills installed: $SKILL_COUNT"
    fi

    # Plugins audit
    if [ -d "$CLAUDE_DIR/plugins" ]; then
        PLUGIN_COUNT=$(find "$CLAUDE_DIR/plugins" -maxdepth 1 -type d 2>/dev/null | wc -l | tr -d ' ')
        echo "[INFO] Claude Code plugins installed: $((PLUGIN_COUNT - 1))"
    fi
fi

# ── Generic AI agent config directories ──
for DIR in "$HOME/.openclaw" "$HOME/.autogpt" "$HOME/.langchain" "$HOME/.crewai"; do
    [ -d "$DIR" ] || continue
    PLATFORM_NAME=$(basename "$DIR" | sed 's/^\.//')
    echo "── $PLATFORM_NAME Configuration ──"

    # JSON config validation
    for CFG in "$DIR"/*.json; do
        [ -f "$CFG" ] || continue
        if command -v jq &>/dev/null; then
            jq '.' "$CFG" > /dev/null 2>&1 && echo "[PASS] $(basename "$CFG") valid JSON" || echo "[FAIL] $(basename "$CFG") invalid JSON"
        fi
    done

    # Credentials directory permissions
    for CRED in "$DIR/credentials" "$DIR/secrets" "$DIR/.env"; do
        if [ -d "$CRED" ]; then
            if [[ "$(uname -s)" == "Darwin" ]]; then
                PERMS=$(stat -f "%Lp" "$CRED")
            else
                PERMS=$(stat -c "%a" "$CRED" 2>/dev/null || echo "unknown")
            fi
            [ "$PERMS" = "700" ] && echo "[PASS] $(basename "$CRED")/ permissions: 700" || echo "[FAIL] $(basename "$CRED")/ permissions: $PERMS (should be 700)"
        fi
        if [ -f "$CRED" ]; then
            if [[ "$(uname -s)" == "Darwin" ]]; then
                PERMS=$(stat -f "%Lp" "$CRED")
            else
                PERMS=$(stat -c "%a" "$CRED" 2>/dev/null || echo "unknown")
            fi
            [ "$PERMS" = "600" ] && echo "[PASS] $(basename "$CRED") permissions: 600" || echo "[FAIL] $(basename "$CRED") permissions: $PERMS (should be 600)"
        fi
    done
done

MCP Server Configuration Audit

Scan all MCP configuration files for dangerous settings, known-malicious packages, and insecure bindings.

echo "── MCP Server Configuration ──"

# Locate all MCP config files
MCP_CONFIGS=()
for MCP_CFG in "$HOME/.mcp.json" "$HOME/.claude/.mcp.json" ".mcp.json" "$HOME/.claude/settings.json"; do
    [ -f "$MCP_CFG" ] && MCP_CONFIGS+=("$MCP_CFG")
done
# Project-level configs
while IFS= read -r -d '' f; do MCP_CONFIGS+=("$f"); done /dev/null)

for MCP_CFG in "${MCP_CONFIGS[@]}"; do
    echo "[INFO] Scanning MCP config: $MCP_CFG"

    # 0.0.0.0 bindings (should be 127.0.0.1)
    if grep -q '0\.0\.0\.0' "$MCP_CFG" 2>/dev/null; then
        echo "[FAIL] MCP config binds to 0.0.0.0 (world-accessible): $MCP_CFG"
    fi

    # Known malicious MCP packages
    MALICIOUS_MCP='postmark-mcp|@anthropic/mcp-proxy|framelink-figma-mcp|mcp-remote'
    if grep -qE "$MALICIOUS_MCP" "$MCP_CFG" 2>/dev/null; then
        echo "[FAIL] Known malicious/vulnerable MCP package in: $MCP_CFG"
        grep -oE "$MALICIOUS_MCP" "$MCP_CFG" 2>/dev/null | sort -u | while read -r pkg; do echo "  → $pkg"; done
    fi

    # External tunnels
    TUNNEL_PATTERNS='bore\.pub|ngrok|cloudflared|localtunnel|serveo\.net|pagekite|localhost\.run'
    if grep -qE "$TUNNEL_PATTERNS" "$MCP_CFG" 2>/dev/null; then
        echo "[FAIL] External tunnel in MCP config: $MCP_CFG"
    fi

    # Unpinned @latest dependencies
    if grep -q '@latest' "$MCP_CFG" 2>/dev/null; then
        echo "[WARN] Unpinned @latest dependency in MCP config: $MCP_CFG"
    fi
done

# Ollama exposure check
if command -v lsof &>/dev/null; then
    OLLAMA_EXPOSED=$(lsof -iTCP:11434 -sTCP:LISTEN -P 2>/dev/null | grep -v "127.0.0.1\|localhost\|::1" || true)
    [ -n "$OLLAMA_EXPOSED" ] && echo "[FAIL] Ollama exposed on non-localhost (port 11434)" || true
fi

[ ${#MCP_CONFIGS[@]} -eq 0 ] && echo "[INFO] No MCP configuration files found"

---

Rules File Injection Detection

Scan IDE/agent rules files for prompt injection and data exfiltration patterns (IDEsaster CVEs: Cursor, Copilot, Windsurf, Claude Code).

echo "── Rules File Injection Scan ──"

RULES_FILES=()
for RF in ".cursor/rules" ".cursorrules" ".github/copilot-instructions.md" ".windsurfrules" ".clinerules" "CLAUDE.md" ".claude/settings.json"; do
    [ -f "$RF" ] && RULES_FILES+=("$RF")
done
# Also check home-level
for RF in "$HOME/.cursorrules" "$HOME/CLAUDE.md"; do
    [ -f "$RF" ] && RULES_FILES+=("$RF")
done

# Injection patterns — attempts to override agent instructions
INJECT_PATTERNS='ignore previous|disregard.*instructions|system prompt override|you are now|IMPORTANT:.*must.*override|forget.*all.*previous|new role:|act as root|'
# Exfiltration patterns — attempts to steal data
EXFIL_PATTERNS='send.*to.*https?://|curl.*-d.*\$|exfiltrate|upload.*credential|wget.*post|fetch\(.*body.*token|nc -e|base64.*\|.*curl'

for RF in "${RULES_FILES[@]}"; do
    INJECT_HITS=$(grep -ciE "$INJECT_PATTERNS" "$RF" 2>/dev/null || echo 0)
    EXFIL_HITS=$(grep -ciE "$EXFIL_PATTERNS" "$RF" 2>/dev/null || echo 0)
    if [ "$INJECT_HITS" -gt 0 ]; then
        echo "[FAIL] Prompt injection patterns ($INJECT_HITS hits) in: $RF"
    fi
    if [ "$EXFIL_HITS" -gt 0 ]; then
        echo "[FAIL] Data exfiltration patterns ($EXFIL_HITS hits) in: $RF"
    fi
    [ "$INJECT_HITS" -eq 0 ] && [ "$EXFIL_HITS" -eq 0 ] && echo "[PASS] Clean rules file: $RF"
done

[ ${#RULES_FILES[@]} -eq 0 ] && echo "[INFO] No IDE/agent rules files found in current directory"

---

Exposed AI Service Detection

Check common AI-related ports for non-localhost bindings.

echo "── Exposed AI Services ──"
if command -v lsof &>/dev/null; then
    for PORT_INFO in "11434:Ollama" "8080:API-Gateway" "3000:Dev-Server" "8000:FastAPI" "5000:Flask"; do
        PORT="${PORT_INFO%%:*}"; SVC="${PORT_IN

…

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [nobrainer-tech](https://github.com/nobrainer-tech)
- **Source:** [nobrainer-tech/nobrainer-claude-skills](https://github.com/nobrainer-tech/nobrainer-claude-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.