Claude Config Validator

Bitwarden's own Claude Code plugin for reviewing Claude configuration. It checks the agents, slash commands, hooks, settings and CLAUDE.md files in a repository or a plugin for security, structure and prompt quality. It reports only what a change introduced, one finding per issue, pinned to its file and line. It's the same review Bitwarden's validate-ai GitHub Action runs on its own pull requests. What it checks - Agents: tool access against least privilege, frontmatter, descriptions and triggers, system prompts and model choice - Slash commands and prompts: purpose, session context, skill references and parameters - Settings and hooks: permission scoping, auto-approved commands, and every hook command read as code that will run - CLAUDE.md: clarity, specificity and length, since it's re-read every turn - Security first, every time: a committed settings.local.json, hardcoded secrets and overly broad permissions How you use it - Ask in your own words, such as "Review my new agent in .claude/agents/", or run /claude-config-validator:reviewing-claude-config - /validate-ai-local reviews what you changed on your branch, plus uncommitted work, and writes a report - /validate-ai reviews a pull request and posts a summary comment to it through the GitHub CLI - Findings are ranked CRITICAL, IMPORTANT, SUGGESTED or OPTIONAL, each with a fix and why it matters How to install it In Claude Code, run /plugin marketplace add bitwarden/ai-plugins, then /plugin install claude-config-validator@bitwarden-marketplace. Good to know - It needs Claude Code 2.1.210 or later. - Skill and plugin-manifest checks come from Anthropic's plugin-dev plugin. Without it, the commands report those sections as skipped. - It also includes a security-scan script you can run yourself on a .claude folder.