How to audit your Claude Code setup before installing anything (Chapter 2)

Do not start by installing. Start by finding out what is missing. The audit is read-only.

1 npx github:yurukusa/cc-safe-setup --audit

On a fresh project with no hooks at all, this is what comes back:

 1   cc-safe-setup --audit
 2   Analyzing your Claude Code safety setup...
 3 
 4   Risks found (9):
 5 
 6   [CRITICAL] No PreToolUse hooks — destructive commands (rm -rf, git reset --hard) can run unchecked
 7   [HIGH] No destructive command blocker detected — rm -rf /, git reset --hard could execute
 8   [HIGH] No branch push protection — code could be pushed directly to main/master
 9   [HIGH] No secret leak protection — .env files could be committed via git add .
10   [MEDIUM] No database wipe protection — migrate:fresh, prisma migrate reset could wipe data
11   [MEDIUM] No PostToolUse hooks — no automatic syntax checking after edits
12   [MEDIUM] No CLAUDE.md found — Claude has no project-specific instructions
13   [LOW] No dotfile protection — ~/.bashrc, ~/.aws/ could be modified
14   [LOW] No scope guard — files outside project directory could be modified
15 
16   Safety Score: 0/100

Trimmed for print: each of the nine findings is followed by a Fix: line naming the exact command, and the real output ends with a --fix suggestion and three “go deeper” links. Those are removed here so the block fits the page; nothing else is edited, and the findings, their order and their severities are as they came back.

Nine findings on an empty project is the baseline, not a crisis. What matters is which of them are still there a week from now — and the score, which Chapter 1 asks you to get above 80.

Two notes on reading this output honestly.

The audit inspects your configuration. It does not watch Claude Code run. A clean audit means “the guards are installed”, not “nothing bad can happen”. The distance between those two sentences is Chapter 4.

The severity labels are the tool’s opinion, not a standard. [LOW] No scope guard is low for a solo project in a scratch directory and high for a machine that also holds your production credentials. Read them against your own situation.