AI Agent Audit

AI Agent Security Audit

Comprehensive security auditing methodology for AI agent endpoints, focusing on Claude Desktop, Claude Code, MCP servers, plugins, extensions, and autonomous execution features.

Origin: Based on CLAUDIT-SEC methodology — read-only audit tool for Claude Desktop/Code configuration analysis.

🎯 Routing & Detection

Detectar Claude Desktop/Code no Alvo

# Process detection (local machine)
pgrep -i "Claude"
pgrep -i "claude-code"

# macOS paths
ls -la ~/Library/Application\ Support/Claude/
ls -la ~/.claude/

# Windows paths
dir "%APPDATA%\Claude"
dir "%USERPROFILE%\.claude"

# Network indicators (remote assessment)
# MCP servers often expose HTTP endpoints on specific ports
nmap -p 8897,8080,3000 target -sV

Sinais de Alerta

• Processo "Claude" em execução
• Diretórios de configuração presentes
• MCP servers ativos (verificar portas 8897, 8080, 3000)
• Scheduled tasks relacionadas ao Claude
• Plugin hooks com shell commands

Ação Imediata

# Se Claude detectado → ATIVAR ai-agent-audit skill
# Executar audit completo com claudit-sec
./claude_audit.sh --json > ai_agent_audit.json

# Se MCP server detectado → Enumerar endpoints
curl -sk http://target:8897/mcp

1. Desktop & Cowork Settings Audit (PTES 2.5)

1.1 Keep-Awake Configuration

File: claude_desktop_config.json → preferences.keepAwakeEnabled

# macOS check
jq '.preferences.keepAwakeEnabled' ~/Library/Application\ Support/Claude/claude_desktop_config.json

# Risk assessment
if keepAwakeEnabled == true:
    # Machine never sleeps → increased attack surface
    # Network reachable for longer periods
    # Physical access window extended

Severity: WARN — Overriding system power management

1.2 Autonomous Execution Flags

Files:

• claude_desktop_config.json → preferences.coworkScheduledTasksEnabled
• cowork_settings.json → various autonomous flags

# Check master switch for autonomous tasks
jq '.preferences.coworkScheduledTasksEnabled' claude_desktop_config.json

# Check Code Desktop scheduled tasks
jq '.preferences.ccdScheduledTasksEnabled' claude_desktop_config.json

# Check web search enabled
jq '.webSearchEnabled' cowork_settings.json

# Check browser use enabled
jq '.browserUseEnabled' cowork_settings.json

Severity: WARN — Autonomous AI execution requires governance review

1.3 Network Mode & Egress Policy

File: config.json, local_*.json

# Check network mode (isolated vs unrestricted)
jq '.networkMode' config.json

# Check egress allowed domains
jq '.egressAllowedDomains' local_*.json

# CRITICAL if egress == ["*"] (unrestricted)
# HIGH if egress includes sensitive domains

Risk Assessment:

2. MCP Server Audit (PTES 2.5.4)

2.1 MCP Server Enumeration

File: claude_desktop_config.json → mcpServers

# List all configured MCP servers
jq '.mcpServers | keys[]' claude_desktop_config.json

# Extract server details
jq '.mcpServers | to_entries[] | {
    name: .key,
    command: .value.command,
    args: .value.args,
    env_keys: (.value.env | keys)
}' claude_desktop_config.json

2.2 Command & Argument Analysis

# Redact sensitive patterns from args
# Patterns to redact: sk-*, key=*, token=*, secret=*, password=*

# Extract and analyze commands
for server in $(jq '.mcpServers | keys[]' claude_desktop_config.json -r); do
    echo "=== Server: $server ==="
    jq -r ".mcpServers[\"$server\"].command" claude_desktop_config.json
    jq -r ".mcpServers[\"$server\"].args[]" claude_desktop_config.json 2>/dev/null
    
    # Check for dangerous patterns
    # - npx with untrusted packages
    # - python with remote scripts
    # - curl | bash patterns
    # - Direct shell execution
done

2.3 Environment Variable Keys

# List env var KEY NAMES only (never values)
jq '.mcpServers | to_entries[] | {
    server: .key,
    env_keys: (.value.env | keys)
}' claude_desktop_config.json

# High-risk env var patterns
# - *_API_KEY, *_SECRET, *_TOKEN
# - AWS_*, AZURE_*, GCP_*
# - DATABASE_URL, CONNECTION_STRING

2.4 MCP Server Risk Scoring

3. Plugin Audit (PTES 2.5.4)

3.1 Plugin Enumeration

Files:

• cowork_plugins/installed_plugins.json
• remote_cowork_plugins/manifest.json
• cowork_plugins/cache/*/

# List installed plugins
jq '.plugins[] | {
    name: .name,
    version: .version,
    author: .author,
    scope: .scope,
    description: .description
}' installed_plugins.json

# Count skills per plugin
for plugin_dir in cowork_plugins/cache/*/*/; do
    plugin_name=$(basename "$plugin_dir")
    skill_count=$(find "$plugin_dir/skills" -name "SKILL.md" 2>/dev/null | wc -l)
    echo "$plugin_name: $skill_count skills"
done

3.2 Plugin Hook Analysis

File: hooks/hooks.json in plugin directories

# Find all plugin hooks
find cowork_plugins -name "hooks.json" -exec jq -r '
    .hooks | to_entries[] | 
    "\(.key): \(.value[].command)"
' {} \;

# High-risk hook events
# - PreToolUse: Executes before tool calls
# - PostToolUse: Executes after tool calls  
# - OnInstall: Executes on plugin install
# - OnStartup: Executes on Claude startup

# CRITICAL: Shell commands in hooks
# Look for: bash, sh, zsh, powershell, cmd.exe

3.3 Plugin Risk Indicators

4. Extension (DXT) Audit (PTES 2.5.4)

4.1 Extension Enumeration

File: extensions-installations.json

# List all installed extensions
jq '.extensions[] | {
    name: .name,
    version: .version,
    author: .author,
    signed: .isSigned,
    signatureStatus: .signatureStatus
}' extensions-installations.json

# Check for unsigned extensions
jq '.extensions[] | select(.isSigned == false)' extensions-installations.json

4.2 Dangerous Tool Grants

# Extensions with dangerous tools
DANGEROUS_TOOLS="execute_javascript write_file edit_file run_command execute_sql"

for tool in $DANGEROUS_TOOLS; do
    echo "=== Extension with $tool ==="
    jq --arg tool "$tool" '.extensions[] | 
        select(.tools[] | contains($tool)) | 
        {name: .name, version: .version}' extensions-installations.json
done

4.3 Extension Settings Audit

Directory: Claude Extensions Settings/*.json

# Check allowed directories per extension
for settings_file in "Claude Extensions Settings"/*.json; do
    echo "=== $(basename "$settings_file") ==="
    jq '.allowedDirectories[]' "$settings_file" 2>/dev/null
    
    # High-risk directories
    # - Home directory (~)
    # - System directories (/etc, /System)
    # - Credential stores (.ssh, .gnupg, Keychains)
done

4.4 Extension Risk Matrix

5. Extension Governance Audit (PTES 3.3)

5.1 Blocklist/Allowlist Status

Files:

• extensions-blocklist.json
• config.json → extensionAllowlist

# Check if blocklist exists and has entries
if [[ -f extensions-blocklist.json ]]; then
    blocklist_count=$(jq '.blocklist | length' extensions-blocklist.json)
    echo "Blocklist entries: $blocklist_count"
else
    echo "WARN: No blocklist found"
fi

# Check allowlist status
jq '.extensionAllowlist' config.json
# If enabled: only allowlisted extensions can run
# If disabled: any extension can run (higher risk)

5.2 Governance Gaps

6. Skills Audit (PTES 2.5.4)

6.1 Skill Path Enumeration

# User skills (source: "user")
SKILL_PATHS=(
    "$HOME/Documents/Claude/Scheduled/*/SKILL.md"
    "$HOME/skills-plugin/*/*/skills/*/SKILL.md"
    "$HOME/.skills/skills/*/SKILL.md"
    "$HOME/.claude/skills/*/SKILL.md"
)

# Installed plugin skills (source: "plugin")
PLUGIN_SKILL_PATHS=(
    "<session>/remote_cowork_plugins/*/skills/*/SKILL.md"
    "<session>/cowork_plugins/cache/*/*/*/skills/*/SKILL.md"
    "$HOME/.claude/plugins/marketplaces/*/{plugins,external_plugins}/*/skills/*/SKILL.md"
)

# Count and catalog skills
for path_pattern in "${SKILL_PATHS[@]}" "${PLUGIN_SKILL_PATHS[@]}"; do
    for skill_file in $path_pattern; do
        [[ -f "$skill_file" ]] || continue
        
        # Extract frontmatter
        name=$(grep -A1 "^name:" "$skill_file" | tail -1 | cut -d: -f2 | tr -d ' ')
        desc=$(grep -A1 "^description:" "$skill_file" | tail -1 | cut -d: -f2-)
        
        echo "Skill: $name"
        echo "Path: $skill_file"
        echo "Description: $desc"
        echo "---"
    done
done

6.2 Skill Content Analysis

# Parse skill frontmatter
parse_skill_frontmatter() {
    local file="$1"
    local content=$(cat "$file" 2>/dev/null)
    
    # Check for frontmatter delimiters
    if [[ "$content" == "---"* ]]; then
        # Extract name, description, type
        local fm=$(echo "$content" | sed -n '2,/^---/{/^---/!p;}')
        
        echo "$fm" | while IFS=: read -r key value; do
            case "$key" in
                name) skill_name="$value" ;;
                description) skill_desc="$value" ;;
                type) skill_type="$value" ;;
            esac
        done
    fi
}

# Risk indicators in skills
# - Shell commands (bash, sh, curl, wget)
# - File operations (write, edit, delete)
# - Network calls (HTTP requests, API calls)
# - Credential handling

6.3 Scheduled Task Skills

# Skills in Scheduled directory have autonomous execution
scheduled_skills="$HOME/Documents/Claude/Scheduled"

if [[ -d "$scheduled_skills" ]]; then
    count=$(find "$scheduled_skills" -name "SKILL.md" | wc -l)
    echo "Scheduled skills (autonomous execution): $count"
    
    # List each scheduled skill
    find "$scheduled_skills" -name "SKILL.md" -exec sh -c '
        echo "=== {} ==="
        grep -E "^(name|description):" "$1"
    ' sh {} \;
fi

7. Scheduled Tasks Audit (PTES 2.5.4)

7.1 Task Enumeration

File: scheduled-tasks.json

# List all scheduled tasks
jq '.tasks[] | {
    id: .id,
    name: .name,
    cron: .cronExpression,
    enabled: .enabled,
    skillName: .skillName,
    skillDescription: .skillDescription
}' scheduled-tasks.json

# Check if scheduled tasks are globally enabled
jq '.preferences.coworkScheduledTasksEnabled' claude_desktop_config.json

7.2 Cron Expression Analysis

# Translate cron to human-readable
# Format: minute hour day month weekday

cron_to_english() {
    local cron="$1"
    local minute=$(echo "$cron" | awk '{print $1}')
    local hour=$(echo "$cron" | awk '{print $2}')
    
    if [[ "$minute" == "0" && "$hour" == "0" ]]; then
        echo "Daily at midnight"
    elif [[ "$minute" == "0" ]]; then
        echo "Hourly at minute $minute"
    elif [[ "$hour" == "*" ]]; then
        echo "Every $minute minutes"
    else
        echo "At minute $minute, hour $hour"
    fi
}

# High-frequency tasks (potential concern)
jq -r '.tasks[] | select(.cronExpression | test("^[*0-9,/-]{1,10} [*0-9,/-]{1,10} ")) | 
    "\(.name): \(.cronExpression)"' scheduled-tasks.json

7.3 Scheduled Task Risk Assessment

8. Connector Audit (PTES 2.5.4)

8.1 Connector Enumeration

File: local_*.json → remoteMcpServersConfig

# List all connectors
jq '.remoteMcpServersConfig[] | {
    name: .name,
    type: .type,  # web, desktop, not_connected
    egressAllowedDomains: .egressAllowedDomains,
    disabledMcpTools: .disabledMcpTools
}' local_*.json

# Check for OAuth-authenticated connectors
jq '.remoteMcpServersConfig[] | select(.authType == "oauth")' local_*.json

8.2 Egress Domain Analysis

# Extract all allowed egress domains
jq -r '.remoteMcpServersConfig[].egressAllowedDomains[]?' local_*.json | sort -u

# CRITICAL: Unrestricted egress
jq '.remoteMcpServersConfig[] | select(.egressAllowedDomains == ["*"])' local_*.json

# HIGH: Wildcard subdomains
jq -r '.remoteMcpServersConfig[].egressAllowedDomains[]?' local_*.json | grep '\*\.'

8.3 Disabled Tools Analysis

# List explicitly disabled MCP tools
jq -r '.remoteMcpServersConfig[].disabledMcpTools[]?' local_*.json

# Check if dangerous tools are NOT disabled
DANGEROUS_TOOLS="execute_javascript write_file edit_file run_command execute_sql"

for tool in $DANGEROUS_TOOLS; do
    if ! grep -q "$tool" <(jq -r '.remoteMcpServersConfig[].disabledMcpTools[]?' local_*.json); then
        echo "WARN: Dangerous tool NOT disabled: $tool"
    fi
done

9. Runtime State Audit (PTES 2.5.4)

9.1 Process Detection

# Check if Claude is running
if pgrep -i "Claude" > /dev/null; then
    echo "INFO: Claude process is running"
    pgrep -i "Claude" | xargs ps -p
else
    echo "INFO: Claude is not running"
fi

# Check for child processes
pgrep -i "Claude" | xargs pstree -p 2>/dev/null

9.2 Sleep Assertion Check

# macOS: Check if Claude is preventing sleep
pmset -g assertions | grep -i "claude"

# If found: Claude is actively preventing system sleep
# This indicates active autonomous execution

9.3 LaunchAgents / Startup

# macOS LaunchAgents
ls -la ~/Library/LaunchAgents/ | grep -i claude
launchctl list | grep -i claude

# Check crontab
crontab -l 2>/dev/null | grep -i claude

# Windows: Check startup
dir "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup" | Select-String claude

9.4 Cookie Analysis

# Check for browser cookies
cookie_path="$HOME/Library/Application Support/Claude/Cookies"

if [[ -f "$cookie_path" ]]; then
    echo "INFO: Cookies file present"
    ls -la "$cookie_path"
    
    # Check permissions (should be restrictive)
    perms=$(stat -f "%A" "$cookie_path")
    if [[ "$perms" != "600" && "$perms" != "400" ]]; then
        echo "WARN: Cookie file permissions too permissive: $perms"
    fi
fi

10. Dispatch Bridge Audit (PTES 2.5.4)

10.1 Dispatch Detection

Files: local_*.json → hostLoopMode, bridge-state.json

# Check hostLoopMode (dispatch acceptance)
jq '.hostLoopMode' local_*.json

# Count sessions accepting dispatch
dispatch_count=$(grep -l '"hostLoopMode"' local_*.json | wc -l)
echo "Sessions accepting dispatch: $dispatch_count"

# Check bridge-state.json for dispatch configuration
if [[ -f "bridge-state.json" ]]; then
    jq '.dispatch' bridge-state.json
fi

10.2 Dispatch Risk Assessment

11. Workspace/Multi-Session Audit (PTES 2.5.4)

11.1 Workspace Enumeration

# Find all session directories
find ~/Library/Application\ Support/Claude -type d -name "local-agent-mode-sessions"

# List workspaces (org directories)
for org_dir in ~/Library/Application\ Support/Claude/local-agent-mode-sessions/*/; do
    org_name=$(basename "$org_dir")
    session_count=$(find "$org_dir" -maxdepth 1 -type d | wc -l)
    
    echo "Workspace: $org_name"
    echo "Sessions: $((session_count - 1))"  # Subtract 1 for . or ..
    
    # Check for org indicators
    if [[ -f "$org_dir/remote_cowork_plugins/manifest.json" ]]; then
        echo "  - Has org-deployed plugins"
    fi
done

11.2 Cross-Session Risk

12. Claude Code Settings Audit (PTES 2.5.4)

12.1 Settings File Analysis

File: ~/.claude/settings.json

# Read Claude Code settings
if [[ -f ~/.claude/settings.json ]]; then
    echo "=== Claude Code Settings ==="
    jq '.' ~/.claude/settings.json
    
    # Check for permission grants
    jq '.permissions' ~/.claude/settings.json 2>/dev/null
    
    # Check for MCP server configs
    jq '.mcpServers' ~/.claude/settings.json 2>/dev/null
fi

12.2 Allowed Tools Check

# Check allowedTools list
jq '.allowedTools[]' ~/.claude/settings.local.json 2>/dev/null

# Dangerous tools to flag
DANGEROUS_TOOLS="Bash Write Edit MultiEdit"

for tool in $DANGEROUS_TOOLS; do
    if jq -e ".allowedTools | index(\"$tool\")" ~/.claude/settings.local.json > /dev/null 2>&1; then
        echo "INFO: Dangerous tool allowed: $tool"
    fi
done

13. Consolidated Risk Scoring

13.1 Risk Calculation

Total Risk Score = Σ(Finding Severity × Weight)

Severity Weights:
- CRITICAL: 10 points
- HIGH: 5 points
- MEDIUM: 3 points
- LOW: 1 point
- INFO: 0 points

13.2 Risk Thresholds

13.3 Finding Categories

14. Reporting Template

14.1 Executive Summary

AI AGENT SECURITY AUDIT
Target: [hostname/user]
Date: [timestamp]
Risk Score: [X]/100 ([LOW/MEDIUM/HIGH/CRITICAL])

Key Findings:
- [X] CRITICAL findings
- [X] HIGH findings  
- [X] MEDIUM findings
- [X] informational findings

Top Concerns:
1. [Most critical finding]
2. [Second concern]
3. [Third concern]

14.2 Technical Findings

## Finding: [FINDING-ID]
**Severity:** [CRITICAL/HIGH/MEDIUM/LOW/INFO]
**Category:** [Autonomous Execution / MCP / Plugin / Extension / Network]

**Description:**
[What was found]

**Evidence:**
[File path, JSON snippet, command output]

**Risk:**
[Why this matters - attack scenario]

**Recommendation:**
[How to remediate]

14.3 JSON Output (SIEM Integration)

{
  "audit_type": "ai_agent_security",
  "target": {
    "hostname": "...",
    "user": "...",
    "timestamp": "..."
  },
  "risk_score": 0,
  "risk_level": "LOW",
  "findings": [
    {
      "severity": "WARN",
      "category": "autonomous_execution",
      "finding": "keepAwakeEnabled",
      "detail": "Claude preventing system sleep",
      "file": "claude_desktop_config.json"
    }
  ],
  "summary": {
    "critical": 0,
    "high": 0,
    "medium": 0,
    "low": 0,
    "info": 0
  }
}

🔧 Integration with Existing Skills

Trigger Routes

MCP Tool Integration

# Use hexstrike-local for deeper analysis
airecon "analyze MCP server commands for injection vulnerabilities"

# Use pentestswarm-remote for campaign
airecon "start pentest campaign against AI agent endpoint"

# Use cve-mcp for vulnerability mapping
airecon "check CVEs for detected MCP server software"

🤖 AIRecon Integration

Invocation Commands

# Full AI agent audit
airecon "AI agent security audit for Claude Desktop"

# MCP server enumeration
airecon "enumerate MCP servers and analyze commands"

# Plugin risk assessment
airecon "assess plugin security risks including hooks"

# Extension audit
airecon "audit Claude extensions for dangerous tools"

# Autonomous execution review
airecon "review scheduled tasks and autonomous execution settings"

Auto-Skill Loading

References

• CLAUDIT-SEC — Claude Desktop/Code audit tool (macOS + Windows)
• PTES Section 2.5 — External Footprinting (AI Agent Surface)
• OWASP Top 10 for LLM — AI-specific security concerns
• MITRE ATLAS — Adversarial Threat Landscape for AI Systems

Ver Também

• /pentest-intelligence-gathering — OSINT para AI agents
• /pentest-post-exploitation — Persistência via AI agents
• /llm-security-testing — Testes de segurança para LLMs
• /pentest-pfsense — Se pfSense detectado durante audit