DOCSEARCHbyAlgolia
Submit Docs

CLAUDIT-SEC Security Auditing Tool

repository·main·Indexed 43 days ago

https://github.com/harmonicsecurity/claudit-sec

A read-only security auditing tool for inspecting Claude Desktop, Cowork, and related extension environments. It identifies security risks, compliance violations, and AI enablement configurations, including audits of MCP servers, DXT extensions, browser automation settings, and remote execution risks via Dispatch.

Tokens
6.5K
Snippets
3
Records
34
Agent score
5%

What's inside CLAUDIT-SEC

  1. Understand the CLAUDIT-SEC findings report format

    main

    The CLAUDIT-SEC findings reference document provides a structured way to interpret security and compliance checks. Each finding in a report follows a consistent schema to help security teams and administrators respond effectively:

    • What: Identifies the specific file, setting, or system state being inspected.
    • Why it matters: Explains the risk, compliance implications, or AI enablement context.
    • Severity: The assigned level (CRITICAL, WARN, INFO, REVIEW) and the rationale behind it.
    • Recommendation: The specific action to take if the finding is flagged.

    Note: CLAUDIT is a read-only tool. It performs observational audits and never modifies audited files.

  2. Inspect Claude Desktop configuration settings

    main

    CLAUDIT-SEC inspects user-facing preferences in Claude Desktop to assess system behavior, power management, and UI exposure. These settings are located in the following configuration files:

    • macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
    • Windows: %APPDATA%\Claude\claude_desktop_config.json

    Findings are derived from the preferences object within these files.

  3. Understand Claude Desktop Dispatch states and risks

    main

    Dispatch is a feature allowing mobile devices to remotely trigger tasks on a desktop machine. CLAUDIT monitors two specific dispatch states to assess remote execution risks:

    1. Dispatch Bridge Configured: Detected via bridge-state.json. If any userUUID:orgUUID pair has enabled: true, the desktop is a potential remote execution target. A compromised mobile device could trigger tasks that access local files, connectors, or tools.
    2. Dispatch Actively Accepting Tasks: Detected via hostLoopMode: true in local_*.json session files. This is a high-risk state where the desktop is actively processing or waiting for tasks from a mobile device, granting the phone high-autonomy control over desktop capabilities.

    Dispatch State Summary

    StateConditionDisplay
    OFFNo bridge configured, no active sessionsOFF (green)
    CONFIGUREDbridge-state.json has enabled: true but no active hostLoopMode sessionsCONFIGURED (yellow)
    ONAny local_*.json has hostLoopMode: trueON (yellow)

    Recommendation: Verify if dispatch is intentionally used. If not, disable it. If enabled, ensure the mobile device has strong security controls (biometrics, MDM).

    // Example of the logic used to determine state:
// If bridge-state.json -> enabled: true AND local_*.json -> hostLoopMode: false => CONFIGURED
// If local_*.json -> hostLoopMode: true => ON

  4. Manage Claude Sleep Prevention Assertions

    main

    On macOS, Claude (via Electron) can use power management assertions to prevent the system from sleeping. This is often caused by long-running Cowork sessions or the keepAwakeEnabled setting.

    Risk: Preventing sleep overrides organizational security policies (like auto-lock) and increases the window for network-based attacks.

    Recommendation: If keepAwakeEnabled is disabled but sleep assertions are still present (detected via pmset -g assertions), investigate active background sessions or long-running tasks.

  5. Audit Plugin Hooks for Command Execution

    main

    Plugin hooks are shell commands registered in hooks/hooks.json that execute automatically during specific Claude session lifecycle events (e.g., Stop, PreToolUse, PostToolUse, UserPromptSubmit, SessionStart).

    Risk: Hooks represent an arbitrary command execution channel. A malicious plugin could use hooks to exfiltrate data (e.g., using curl on a Stop event) or modify tool inputs (e.g., using PreToolUse). High-frequency events like PreToolUse or PostToolUse run on every tool call.

    Recommendation: Review all hook commands. Be especially cautious of hooks that:

    • Make network calls (curl, wget, etc.).
    • Run on high-frequency events (PreToolUse, PostToolUse).
    • Reference paths outside ${CLAUDE_PLUGIN_ROOT}.
    • Execute arbitrary interpreters (python3, node, bash) with complex scripts.

    Severity: WARN.

  6. Review Disabled Scheduled Tasks

    main

    Tasks where enabled is false in scheduled-tasks.json are listed in the CLAUDIT report but do not trigger a warning.

    Why it matters: Even if disabled, the configuration and SKILL.md files remain on disk, representing a history of configured autonomous workflows that could be re-enabled.

    Recommendation: Clean up disabled tasks that are no longer required to reduce the footprint of potential autonomous workflows.

  7. Audit Desktop and Not Connected Connectors

    main

    CLAUDIT enumerates connectors that are not OAuth-authenticated:

    • Desktop Connectors: Local extensions and MCP (Model Context Protocol) servers acting as local integrations.
    • Not Connected Connectors: Integrations defined in remote plugin .mcp.json files that are available but not yet authenticated.

    Security Implications:

    • Visibility: Desktop connectors show local tool integrations. Not-connected connectors show potential access points that could become active upon authentication.

    Severity: Displayed in report (No individual finding generated).

    Recommendation: Review desktop connectors during MCP/Extensions reviews. For not-connected connectors, assess the potential access they would grant if authenticated.

  8. Identify and audit Claude Desktop Workspaces

    main

    Claude Desktop can manage multiple workspaces (e.g., Personal, Teams, Enterprise) simultaneously. CLAUDIT inventories these by enumerating user UUID directories in local-agent-mode-sessions/ and checking config.json for DXT allowlist keys.

    Workspace Indicators

    Use these indicators to distinguish between personal and organizationally managed workspaces:

    • DXT-managed: config.json contains dxt:allowlistEnabled:<userUUID>: true. Indicates organizational extension governance (Enterprise).
    • org-plugins: The remote_cowork_plugins/ directory exists under the user UUID. Indicates the workspace receives org-deployed plugins (Teams/Enterprise).
    • dispatch-bridge: bridge-state.json has enabled: true for the specific user UUID.

    Note: Plan types (Free, Pro, etc.) are not stored locally; CLAUDIT infers them using the indicators above.

  9. How the CLAUDIT-SEC Recommendations Engine works

    main

    The Recommendations Engine generates actionable summaries at the end of a report. Recommendations are not just direct copies of findings; they are derived from a combination of findings and collected data to provide high-level guidance.

    Recommendations are triggered when the system detects specific states, such as:

    • Active scheduled tasks or Keep Awake being ON.
    • Unsigned extensions or extensions with dangerous tools.
    • Unrestricted Cowork VM network egress.
    • Enabled web search or browser actions.
    • Configured MCP servers or plugin hooks executing commands.
    • Remote plugins being deployed.
    • Authenticated web connectors or a configured Dispatch bridge.

  10. Understand CLAUDIT-SEC data inventory (Non-finding data)

    main

    CLAUDIT-SEC collects various data points to provide context in reports, even if they do not trigger a specific security finding. This data serves as an asset inventory for auditing purposes.

    Inventory Categories:

    • Desktop & Cowork Settings: UX configuration (menu bar, sidebar), plugin ecosystem, network mode, and egress domain lists.
    • Extensions & Plugins: Full tables of installed/cached extensions, their allowed directories, tool declarations, and plugin hooks (plugin, event, command).
    • MCP (Model Context Protocol): Full server table including names, commands, arguments, and environment variables.
    • Connectors & Skills: Integration status (web connectors) and behavior/prompt inventory (user and plugin skills).
    • Workspaces: Multi-account inventory including user UUID, account name, email, and session counts.
    • Dispatch: The three-state display of the mobile-to-desktop bridge (OFF/CONFIGURED/ON).
    • App Config: Network mode and device ID (ant-did).

  11. Understand and audit Web Connectors

    main

    Web Connectors are OAuth-authenticated cloud services (e.g., Google Drive, Slack, GitHub) that Claude can interact with. CLAUDIT identifies these by looking for remoteMcpServersConfig in session files.

    Security Implications:

    • Risk: Each authenticated connector is a live connection. A compromised session could allow an attacker to read from or write to these external services autonomously.
    • Compliance: These connections represent data processing relationships that may require documentation for GDPR or SOC 2.

    Severity: INFO (Inventory only).

    Recommendation: Verify all authenticated connectors are approved, review the sensitivity of the data they access, and revoke unused connections.

  12. Review User-Created and Plugin Skills

    main

    Skills are SKILL.md files containing reusable prompts and instructions for Claude. They define the agent's behavior.

    User-Created Skills

    Scanned from various filesystem paths (e.g., ~/Documents/Claude/Scheduled/*/SKILL.md, ~/.claude/skills/*/SKILL.md).

    • Risk: Malicious skills can instruct Claude to exfiltrate data or perform unauthorized file modifications. Since they are user-written, they bypass marketplace reviews.
    • Severity: Displayed in report tables.

    Plugin Skills

    Scanned from plugin-specific paths (e.g., org-deployed remote plugins or Claude Code marketplace plugins).

    • Visibility: Helps assess the scope of third-party influence on Claude's behavior.
    • Severity: Displayed in report tables.

    Recommendation: Review the content of all skills, especially those for scheduled tasks or those referencing external services/filesystems. Focus on org-deployed plugin skills as they affect all users.