Production Agent Security Hardening Toolkit

The vulnerability exists. The exploit toolkit exists. The only question is whether your instance is one of the 21,639 exposed ones — and whether you will find out on your own terms or someone else's. This SKILL.md is the complete security audit and hardening suite for Claude Code deployments.

---

⚡ What's Inside

• Instance Exposure Audit Step-by-step checklist to identify whether your gateway is publicly reachable, whether authentication is configured, and your exact risk level. Five-minute audit with specific remediation for each finding

• Credential Protection Where API keys and secrets should and should not live in an Claude Code deployment. Key rotation procedures for all seven major integrations and Fernet key management. Includes the audit command that shows what is currently at risk

• Skill Verification Protocol The ClawHavoc attack family explained — unauthorized outbound calls, system prompt tampering, persistence mechanisms, and lateral movement. Pre-installation checklist and the exact grep patterns that catch malicious skill content before it runs

• Access Control Framework Gateway token configuration, session sandboxing for isolated workloads, filesystem restriction patterns, and the bash validator rules that block privilege escalation at the command level

• Incident Response Five-minute containment sequence, token revocation order (highest-blast-radius first), full recovery checklist, and post-incident hardening steps

---

🏭 Why This Exists Now

CVE-2026-25253 is a real vulnerability in the Claude Code infrastructure. ClawHavoc is a real exploit toolkit. The 21,639 number is from active scanning data. This is not a theoretical threat model — it is the current threat landscape for Claude Code operators. This toolkit was built in direct response to it.

---

🆕 v1.0 — Initial Release

• Complete five-section hardening framework
• All ClawHavoc attack vectors documented with detection patterns
• Emergency quick-reference card included

---

✅ Core Capabilities

• ✅ Five-minute instance exposure audit — know your risk level before anything else
• ✅ ClawHavoc attack detection — grep patterns that catch malicious skill content pre-install
• ✅ Key rotation checklist — all seven integrations, revocation order documented
• ✅ Session sandboxing configuration — filesystem restrictions for isolated sessions
• ✅ Incident response sequence — containment, revocation, recovery, hardening
• ✅ Emergency command reference — everything you need when time is short