claude-settings-auditorlisted

Claude Code's behavior is the *merge* of up to five settings sources — and the merged result is what nobody ever reads. This skill reads it for you: every layer, precedence applied, with each risky or dead rule called out and a safer replacement proposed. Run it on a freshly cloned repo before working in it, or on your own setup before granting more autonomy. ## When to use this skill - You cloned a repo with a checked-in `.claude/settings.json` (and maybe `.mcp.json` and hooks) and want to know what you're trusting before the first session. - Your permission prompts feel wrong — too many, too few — and you want the effective rule set explained. - You're about to loosen the reins (acceptEdits, broader allows, CI automation) and want the floor checked first. ## When NOT to use this skill - You want to *write* a specific hook — that's [hook-writer](/skills/workflow/hook-writer). - You're auditing the application's code for vulnerabilities — that's the [security-auditor](/agents/quality-security/security-auditor) agent; this skill audits the agent harness configuration itself. ## Instructions 1. **Collect every layer.** Read `~/.claude/settings.json`, `.claude/settings.json`, `.claude/settings.local.json`, and check for managed policy files (platform-specific admin paths). Include `.mcp.json` and any `.claude/hooks/` scripts referenced. Note which files exist, which are committed to the repo, and which are personal. 2. **Compute the effective configuration.** Apply precede