claude-settings-audit

Analyze a repository to generate recommended Claude Code settings.json permissions. Use when setting up a new project, auditing existing settings, or determining which read-only bash commands to allow. Detects tech stack, build tools, and monorepo structure.

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-structured skill with copy-paste-ready command tables and a clear phased workflow. The main gaps are mild redundancy in the rules sections and a fully monolithic body with no progressive disclosure via reference files.

Suggestions

Add an explicit validation checkpoint in Phase 4, e.g. verify the generated JSON parses and confirm every entry is read-only against the "What to NEVER Include" list before presenting output.

Move the large Sentry skills list and the per-stack command/MCP catalogs into reference files (e.g. references/allow-lists.md) and link to them from SKILL.md to reduce inline bulk.

Consolidate the "Important Rules" and "Package Manager Rules" sections with the detection tables to remove restated duplication.

Dimension	Reasoning	Score
Conciseness	Mostly efficient reference tables and command listings without explaining concepts Claude already knows, but the "Important Rules" and "Package Manager Rules" sections partially restate the detection tables, and the example output-format block adds length.	4 / 5
Actionability	Fully executable throughout: concrete detection commands (find/cat), copy-paste-ready allow-list JSON, and explicit tables mapping detected lock files to specific commands covering the common stacks.	5 / 5
Workflow Clarity	Clear phased sequence (Detect Tech Stack → Detect Services → Check Existing Settings → Generate Recommendations) with an existing-settings checkpoint, but there is no explicit validation of the final generated JSON or confirmation that no state-modifying commands slipped in (the "Important Rules" section acts as an implicit checklist but not a verify step).	4 / 5
Progressive Disclosure	Well-organized with clear section headers, but the entire skill is a single inline file over 50 lines with no bundle files or one-level-deep references; large catalogs (the 24-entry Sentry skills list, MCP configs, full command tables) are inlined rather than split into reference files.	3 / 5
	Total	16 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that clearly states capabilities and provides explicit, natural trigger conditions. Minor room to add synonyms or file extensions for broader trigger coverage.

Dimension	Reasoning	Score
Specificity	Names the domain ("generate recommended Claude Code settings.json permissions") and several concrete actions ("Detects tech stack, build tools, and monorepo structure"), but the verbs remain somewhat high-level rather than enumerating the full set of outputs.	4 / 5
Completeness	Explicitly answers both what (analyze repo, generate settings.json permissions, detect stack) and when ("Use when setting up a new project, auditing existing settings, or determining which read-only bash commands to allow") with concrete trigger phrases.	5 / 5
Trigger Term Quality	"Use when setting up a new project, auditing existing settings, or determining which read-only bash commands to allow" gives good natural trigger phrases, though synonyms and explicit file/extension terms are limited.	4 / 5
Distinctiveness Conflict Risk	Targets a clear niche (Claude Code settings.json permission auditing) with distinct triggers, and the "read-only bash commands to allow" framing minimizes overlap with general project-setup skills.	5 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: administrakt0r/AI-Agents-Safe-Coding-Skills
Path: skills/claude-settings-audit/SKILL.md
Commit: fbdfd63

Reviewed: about 17 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.