Security audit of the AI agent setup - Claude Code and agy settings, permissions, hooks, MCP servers, agents, skills and instruction files - for secrets, risky permissions, download-and-run hooks, unpinned servers and prompt injection (no tokens in Claude Code; in agy run `!team audit`)
Installs into .claude/skills of the current project.
Sponsors
SSkills DirectorySkills Directory
Know which skills are safe — weekly.
SSkills DirectorySkills Directory
Is that skill safe to install?
Are you the author of Audit?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/antostr-audit)
---
name: audit
description: Security audit of the AI agent setup - Claude Code and agy settings, permissions, hooks, MCP servers, agents, skills and instruction files - for secrets, risky permissions, download-and-run hooks, unpinned servers and prompt injection (no tokens in Claude Code; in agy run `!team audit`)
argument-hint: "[--strict] [--json]"
disable-model-invocation: true
---
In Claude Code a hook answers this command without the model; you only see it when that hook
did not run. Then run `python3 <team skill folder>/scripts/tw.py audit $ARGUMENTS`
from the repository root and show its output. If the user asks for fixes, propose them one by
one and change configuration only after they agree; never print a secret, and tell the user
to rotate any secret the audit found.
