claude-config

Audit Claude Code configuration files, including settings.json, settings.local.json, .mcp.json, hooks, plugins, permissions and environment variables, for correctness, security, and drift against current official docs. Use when: 'audit settings', 'check config', 'check for config drift', after a Claude Code update, or when permissions, hooks, plugins, or MCP servers may be misconfigured; pass --fix to apply auto-correctable findings with confirmation.

Audit a repo's Claude Code automation landscape, covering hooks, MCP servers, skills, subagents and scheduled tasks, against the enforcement hierarchy, producing PASS/REJECT/CONDITIONAL verdicts backed by evidence. The default verdict is REJECT because most gaps are already covered by compiler/analyzer/build-time checks. Use when: 'audit automations', 'what automations should we add', 'are we missing any hooks', 'hook gap analysis', 'should I add an MCP server for X'; pass --implement to apply approved items, or filter by category (hooks|mcp|skills|subagents|scheduled).

Audit locally-owned Claude Code instruction surfaces, including CLAUDE.md, a natively read AGENTS.md, .claude/rules, skill bodies, agent definitions, hook instruction text and output styles, for instructions current models no longer need (prior-model workarounds, over-prescriptive scaffolding, stale examples), instructions that misstate Claude Code's own behavior or cite files in forms that never load, and cross-surface conflicts where two surfaces contradict each other. Report-only: proposed diffs gated to the human, never auto-applied. Use when: 'audit instructions' or 'instruction audit', including after a model upgrade ('are my instructions holding the model back', 'too prescriptive'); a harness claim looks stale ('stale Claude Code behavior', 'my @path import is not loading', 'instruction re-reads CLAUDE.md'); or two surfaces disagree ('conflicting instructions', 'which instruction wins'). Not a brevity pass and not memory-layer hygiene.

Run ONE coordinated, ordered, resumable pass over a named target repository: a three-scope inventory first (managed policy read-only, user scope routed as recommendations, project scope), then delegated checks lane by lane, findings persisted per lane so an interrupted run resumes instead of restarting, and one human gate for the whole pass instead of one per skill. Adds run semantics, not checks: every check belongs to the plugin that owns it and is invoked presence-gated. Read-only on bare invocation; edits only behind an explicit --fix override, and never to managed policy or user-scope files. Use when: 'audit pass', 'run one pass over this repo', 'coordinate the audit skills', 'audit this repo end to end', 'resume the audit', 'one reconciled findings report', 'sweep all three scopes', or before a release that needs a single diffable findings artifact.

Audit Claude Code permission GRANTS for portability and auto-mode durability. Scans skill/command/agent frontmatter allowed-tools and settings.json/settings.local.json/user-global permissions.allow for interpreter-wildcard rules dropped in auto mode, hardcoded machine/user paths, tilde-user paths, substitution tokens that stay literal in the scope they are written in, and inert plugin self-grants. Use when: 'check permission rules', 'why was my allowed-tools grant ignored', 'audit allow rules', 'is this permission portable', after authoring a code-execution grant, or when a guarded helper is denied despite an allow rule. Report-only.

Report the Claude Code permission state actually in effect. Discovers every settings scope (managed policy, user-global, project, local, and the pre-v2.1.211 start-directory copy), merges them into the effective allow/ask/deny set with each rule's source and precedence mechanic named, and classifies which allow rules auto mode drops on entry. Use when: 'what permissions are actually in effect' or 'show me my effective permissions' (including which settings file a rule comes from and what scopes were checked); 'which of my rules survive auto mode' (the entry diff); 'is my managed policy being read'; or before changing a permission rule whose source is unknown. An allow rule ignored because of its shape is `audit-permission-grants`. Report-only, never writes any settings file.

Audit locally-owned instruction components (skills, agents, hook text, output styles, CLAUDE.md, a natively read AGENTS.md, rules) for MISSING posture guidance the official prompting guide says their purpose needs: delegation criteria, scope and test-gaming guardrails, grounding, autonomy and stop rules with done criteria, destructive-action confirmation, context budget, multi-window and task-file state, parallel tool calls, end-of-run report shape. The additive complement to audit-instructions, which finds text present and wrong. Report-only, proposals gated to the human. Use when: 'posture audit', 'audit prompting postures', 'is my skill missing guardrails', 'missing delegation criteria', 'should this component confirm destructive actions', 'does my CLAUDE.md say when to stop', 'align my components with the prompting guide', or after authoring a skill or agent. Not for rewriting existing instructions (audit-instructions), skill lint (skill-quality:check), or brevity (docs-hygiene:compress).

Draft an `autoMode` classifier block for Claude Code by interviewing the user about what should and should not be auto-approved, then printing a paste-ready JSON block to stdout. Entries follow the shape the classifier actually reads well: a label, bulleted COVERED / NOT COVERED, one line of rationale. Every section keeps `"$defaults"` so customizing does not discard the built-in rules. Use when: 'help me write auto mode rules', 'draft an autoMode block', 'set up auto mode', 'add an auto-mode rule for X', 'my auto mode rules are too vague', 'rewrite this classifier entry', or after an audit shows rules being dropped or ignored. Prints only, never writes any settings file.

Verify claude-config's readiness for this repository: the external CLI prerequisites its audit scripts need, jq (the JSON-parsing audit scripts) and curl (the plugin-drift check), and the tracked suppression record audit-pass reads at .claude/audit-pass.md, so the audit skills run instead of failing. Use when: 'set up claude-config', 'configure claude-config', 'is claude-config working', 'set up audit-pass suppressions', or an audit skill reported a missing prerequisite. Actions: check (read-only verification, default) | apply (resolve what check found). Re-runnable and safe.

Empirical bare-baseline experiment on a repo's standing instructions: reversibly strip project CLAUDE.md and a natively read AGENTS.md/rules/behavioral hooks/skills on a dedicated branch, work normally against the bare model logging observed stumbles to a ledger, then re-add ONLY instructions with repeated same-cause evidence, each restore citing its ledger rows. Measures the model where sibling audit-instructions judges the text. Use when: 'unhobble', 'run the bare experiment', 'delete my CLAUDE.md and see', 'does the model still need these instructions', 'new model dropped, re-baseline', 'instruction ablation experiment'. Human-gated mutations; resumable state.