Claude General

Coding Agent Audit Prompts: 6 for the Tool That Already Has Your Credentials

Plugin4Shell hit Claude Code, Codex, GitHub Copilot and Gemini CLI with the same zero-click flaw, and two of them still have no fix. Updating takes thirty seconds. Working out what your agent can actually reach takes longer, and almost nobody has done it. These six prompts are that audit.

⌨️ 6 prompts 🕐 Updated Sep 21, 2026

💡 How to use these prompts: Replace everything in [BRACKETS] with your specific details before sending. Click Copy to copy any prompt to your clipboard instantly.

List what the agent can actually reach

Most people have never seen this list for a tool they use every day.

You are auditing an AI coding agent installed on my machine. Here is its configuration: [PASTE CONFIG OR SETTINGS]

Tell me every external system this agent can reach, every credential it can read, and every command class it can run.

Then rank those by what an attacker would want most. Do not describe the intended behaviour. Describe the reachable surface.

Find out which plugins are actually loaded

Plugin4Shell needed a plugin you already trust. The list is usually shorter and stranger than expected.

Here is my coding agent plugin configuration and lockfile: [PASTE]

For each plugin tell me: what it claims to do, where it is hosted, whether it is pinned to a commit or a tag, and when it was last updated.

Flag anything hosted outside a major platform, anything unpinned, and anything I probably added once and forgot.

Check the pin is a pin

The whole flaw was that four agents never verified the checkout landed on the pinned commit.

Explain how [MY AGENT] resolves a plugin pinned to a commit hash, and how I can verify from the command line that the code I have actually matches that commit.

Give me the exact git commands to confirm the checkout landed where the pin says, and show me what a mismatch would look like.

Scope the credentials down

The fix for an agent with too much access is less access, not a better agent.

My coding agent currently has: [LIST TOKENS, KEYS, SSH ACCESS, CLOUD ROLES]

For the work I actually do - [DESCRIBE] - tell me the minimum set. For each credential I listed say whether it is required, occasionally useful, or unnecessary, and what the worst realistic outcome is if it leaks.

Assume the agent is compromised. Do not reassure me.

Write the uninstall plan for a deprecated tool

Gemini CLI was deprecated rather than fixed. Deprecated tools keep running until you remove them.

I have [TOOL] installed and the vendor has deprecated it rather than patching a known flaw.

Write me a complete removal plan: the binary, config directories, cached plugins, shell integrations, editor extensions, scheduled jobs, and any credentials it was issued that should now be revoked.

Tell me what to revoke first and what will break when I remove it.

Decide whether to keep an unpatched tool

Sometimes continuing is the right call. It should be a decision rather than a drift.

[TOOL] has a known unpatched vulnerability. I use it for [DESCRIBE WORK].

Lay out my options honestly: keep using it with reduced permissions, switch to an alternative, or stop until a fix ships. For each, tell me the real cost and the residual risk.

Do not default to the cautious answer. Tell me what the trade actually is.