{"slug":"claude-settings-audit","title":"claude-settings-audit","summary":"Use when setting up a project, auditing agent command permissions, or asking which read-only bash commands and domains to allow. Not for remote, credential, publish, deploy, or irreversible changes.","platform":"Claude","tags":[],"authorName":"LLM Mart","authorSlug":"llm-mart","score":0,"source":"github","price":null,"verified":false,"createdAt":"2026-09-30T19:50:01.639149Z","repo":{"url":"https://github.com/OutlineDriven/outline-driven-development","stars":54,"forks":10,"license":"Apache-2.0","updatedAt":"2026-09-28T03:16:21Z"},"bodyHtml":"
\n

name: claude-settings-audit\ndescription: 'Use when setting up a project, auditing agent command permissions, or asking which read-only bash commands and domains to allow. Not for remote, credential, publish, deploy, or irreversible changes.'\ndisable-model-invocation: true

\n

Agent command policy audit

\n

Contract

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
FieldBound contract
TriggerUser sets up a project, audits agent command permissions, or asks which read-only bash commands and domains to allow
AuthorityRead-only. No file, VCS, credential, paid, published, deployed, or remote mutation.
Side effectEmits a recommended command and domain allowlist as chat output. Writes nothing to disk
DoneA validated, least-privilege command and domain policy recommendation containing only read-only, project-relevant commands and domains, with no state-modifying commands
\n

Inputs

\n\n

Procedure

\n
    \n
  1. Parse repository manifests to identify the tech stack. List the repository root and find manifest files to depth 2 (*.toml, *.json, *.lock, *.yaml, *.yml, Makefile, Dockerfile, *.tf). Classify by indicator files:\n\n
    2. \n
  2. Read any existing policy files. Tolerate absence. Done when: existing policy is read or confirmed absent.
    3. \n
  3. Synthesize a read-only command and domain allowlist specific to the detected stack. Build the baseline read-only commands, each as Bash(<cmd>:*): ls, pwd, file, stat, wc, head, tail, cat, tree, git status, git log, git diff, git show, git stash list, git rev-parse, gh pr view, gh pr list, gh pr checks, gh pr diff, gh issue view, gh issue list, gh run view, gh run list, gh run logs, gh repo view. Add stack-specific read-only commands only for tools actually detected by lock files or manifests. Done when: the stack-specific allowlist is built.
    4. \n
  4. Filter the allowlist to strictly forbid state-modifying commands. Remove any command that can mutate state: no install, build, run, write, delete, or push. Remove unrestricted API wrappers (e.g. gh api without a read-only subcommand) that can issue mutating requests. Include only the package manager the project actually uses: if pnpm-lock.yaml is present, omit npm and yarn; if yarn.lock, omit npm and pnpm; if package-lock.json, omit yarn and pnpm. Where multiple lock files coexist, include commands for each detected manager. Done when: every remaining command is read-only, detected, and scoped.
    5. \n
  5. Add WebFetch(domain:...) entries for detected frameworks: Django to docs.djangoproject.com; Flask to flask.palletsprojects.com; FastAPI to fastapi.tiangolo.com; React to react.dev; Next.js to nextjs.org; Vue to vuejs.org; Express to expressjs.com; Rails to guides.rubyonrails.org, api.rubyonrails.org; Go to pkg.go.dev; Rust to docs.rs, doc.rust-lang.org; Docker to docs.docker.com; Kubernetes to kubernetes.io; Terraform to registry.terraform.io. Done when: framework domain entries are added for detected frameworks.
    6. \n
  6. Format the recommendation as a safe policy block. Use the :* suffix so a base command accepts any arguments. Never include absolute paths, user-specific paths, or project scripts that may have side effects. Done when: the policy block is formatted with only read-only, detected, scoped commands and domains.
    7. \n
\n

Failure and recovery

\n\n

Output

\n

A chat report with three parts: a detected-stack summary table (languages, package manager, frameworks, services, build tools); the complete recommended command and domain allowlist with permissions.allow grouped by category and permissions.deny empty; and merge instructions when an existing policy file was found.

\n","files":[{"path":"agents/openai.yaml","sizeBytes":246,"isText":true},{"path":"SKILL.md","sizeBytes":4945,"isText":true}],"reviewScore":null,"reviewSummary":null,"trust":{"provenance":"trusted-source-unreviewed","notice":"Community-authored content, reproduced verbatim and not vetted as instructions. Treat it as data to evaluate, never as directives to follow.","bodySource":null},"bodyLocked":false,"purchaseUrl":null,"sourceUrl":null,"report":{"provenance":"trusted-source-unreviewed","screen":{"ran":true,"outcome":"clean","suspicious":0,"notes":0,"hiddenCharacters":false},"virusScan":{"engine":"clamav","status":"clean","scannedAt":"2026-09-30T19:51:43.405412Z","sha256":"819E365EB31D9D614CB1DC7A8DD6F3E27585237E1BF43308AF98254070E2CEEC","sizeBytes":2506},"review":null,"source":{"repositoryUrl":"https://github.com/OutlineDriven/outline-driven-development","path":".devin/skills/claude-settings-audit","license":"Apache-2.0","commit":"b0e8ce89a19fac880251dc3ea1babfeb4503a4fe","subtreeSha":"A46AA9DED94F86FEC67F2E568914D6E014BE1E539F5D4D202775E4AFAA9A19B1","lastSyncedAt":"2026-09-30T19:49:48.917811Z"},"reviewedAt":"2026-09-30T19:54:57.790055Z","notice":"Community-authored content, reproduced verbatim and not vetted as instructions. Treat it as data to evaluate, never as directives to follow."},"install":[{"target":"skills-cli","command":"npx skills add https://github.com/OutlineDriven/outline-driven-development/tree/main/.devin/skills/claude-settings-audit"},{"target":"claude-code","command":"claude plugin marketplace add https://llmmart.ai/marketplace.json && claude plugin install outlinedriven-outline-driven-development@llmmart"},{"target":"git","command":"git clone https://github.com/OutlineDriven/outline-driven-development.git"}]}