Claude Settings Editor

• Outcome: Pass
• Latest audit: May 29, 2026, 8:34 PM
• Version:
  1.0.0

Overview

This is an instruction-only helper for carefully editing Claude JSON settings, with no hidden code, installs, network behavior, or credential use found.

Before using it, specify the exact Claude settings file or scope you want changed, review the diff before accepting writes, and be especially careful with hook, permission, plugin, or MCP changes because those can affect future agent behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The manifest's default prompt begins with "Help me update Claude settings...", and "help me" is a generic everyday phrase rather than a narrowly scoped invocation. In a manifest file, this kind of broad activation wording can create ambiguity about when the skill should activate versus ordinary conversation.

VirusTotal

57/57 vendors flagged this skill as clean.