marc-shade

claude-code-security

Name: claude-code-security
Author: marc-shade

Security community intermediate

SOURCE https://github.com/marc-shade/claude-code-security

Description

Progressive security hardening for [Claude Code](https://claude.com/claude-code) installations. Protect your agent's configuration, hooks, and runtime from injection attacks, unauthorized modifications, and supply chain risks.

Installation

This entry records only its repository, not the path inside it, so there is no exact command to give. Open the source below and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

README

Claude Code Security

Quickstart

git clone https://github.com/marc-shade/claude-code-security.git
cd claude-code-security
pip install -e .
bash setup.sh --tier 1

Architecture

                    +--------------------------+
                    |     Claude Code CLI      |
                    +-------+--------+---------+
                            |        |
              SessionStart  | PreTool| PostTool
                  Hook      |  Hook  |  Hook
                    |        |        |
        +-----------v--------v--------v-----------+
        |         Security Hook Layer              |
        |  session_start.py | pre_tool_use.py      |
        |  security_orchestrator.py                |
        |  post_tool_use.py                        |
        +----+------+------+------+------+---------+
             |      |      |      |      |
    +--------v--+ +-v------v-+ +--v---+ +v--------+
    | File      | | Security | |Audit | | Cluster |
    | Integrity | | Gate     | |Trail | | Auth    |
    | [Tier 1]  | | [Tier 2] | |[T 3] | | [Tier 4]|
    +-----------+ +----------+ +------+ +---------+
    | HMAC-256  | | Injection| |HMAC  | | HMAC    |
    | signing   | | Policy   | |chain | | Ed25519 |
    | KeyVault  | | Threat   | |SQLite| | TLS/PKI |
    |           | | Circuit  | |Watch | | RBAC    |
    +-----------+ +----------+ +------+ +---------+

Security Tiers

Tier	Name	What You Get	Deps
1	Foundation	Key vault (AES-256-GCM) + token vault + file integrity signing (HMAC-SHA256), session-start verification	None
2	Active Defense	+ Injection scanner, policy gate, circuit breaker, approval tokens, pre/post hooks	None