claude-settings-audit
Audit Claude Code Permissions
Unsafe or missing Claude Code permissions can slow repository setup and create avoidable risk. This skill inspects project tooling and proposes settings that match detected files and services.
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "claude-settings-audit" from https://skillstore.io/skills/getsentry-claude-settings-audit.md and its manifest at https://skillstore.io/api/skills/getsentry-claude-settings-audit/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "claude-settings-audit". A Python service with poetry.lock, Dockerfile, Makefile, and existing Claude Code settings.
Expected outcome:
- A summary table listing Python, Poetry, Docker, Make, and any detected services.
- A recommended settings section grouped by baseline, Python, Docker, and Make commands.
- Merge notes that explain which existing permissions should stay or be narrowed.
Using "claude-settings-audit". A Node.js monorepo with pnpm-lock.yaml, turbo.json, React, and Sentry packages.
Expected outcome:
- A detected stack summary for Node.js, pnpm, Turborepo, React, and Sentry.
- A permissions recommendation focused on pnpm and repository inspection commands.
- WebFetch and Sentry skill suggestions tied to the detected framework and service.
Using "claude-settings-audit". A repository with Terraform files and no current Claude Code configuration.
Expected outcome:
- A warning to review infrastructure-related commands before adding them.
- A first settings recommendation limited to detected infrastructure tooling.
- Notes about keeping secrets out of MCP and settings files.
Security Audit
High RiskThe static Ruby backtick findings are false positives caused by Markdown code fences and inline command examples. A real semantic issue remains: the skill recommends broad wildcard Claude Code Bash permissions that can allow non-read-only or sensitive actions.
Confirmed security concerns (1)
Risk Factors
⚙️ External commands (81)
📁 Filesystem access (3)
🔑 Env variables (1)
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/getsentry-claude-settings-audit/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/getsentry-claude-settings-audit?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/getsentry-claude-settings-audit?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/getsentry-claude-settings-audit/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/getsentry-claude-settings-audit.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
getsentry. (2026). claude-settings-audit security audit report (audit version 7) [Author version unspecified]. Skillstore. https://skillstore.io/skills/getsentry-claude-settings-audit/audits/7BibTeX citation
@techreport{getsentry-getsentry-claude-settings-audit-2026,
author = {getsentry},
title = {claude-settings-audit security audit report (audit version 7)},
institution = {Skillstore},
year = {2026},
number = {7},
url = {https://skillstore.io/skills/getsentry-claude-settings-audit/audits/7},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "claude-settings-audit security audit report (audit version 7)"
version: "unspecified"
type: report
authors:
- name: "getsentry"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/getsentry-claude-settings-audit/audits/7"
identifiers:
- type: other
value: "skillstore:getsentry-claude-settings-audit:audit:7"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: MediumWhat You Can Build
Set up a new repository
Generate initial Claude Code settings from detected project files and package managers.
Review existing permissions
Compare current settings with detected tooling and identify missing or unnecessary entries.
Prepare Sentry project tooling
Find Sentry-specific signals and suggest related skills, documentation domains, and MCP notes.
Try These Prompts
Audit this repository and recommend Claude Code settings for read-only project inspection.
Review the existing .claude/settings.json and explain what should be kept, removed, or added.
Detect each workspace in this monorepo and propose Claude Code permissions for the tools actually present.
Audit the proposed Claude Code allowlist and identify any command patterns that are broader than read-only access.
Best Practices
- Review every recommended wildcard permission before adding it to a shared repository.
- Keep literal API tokens out of .mcp.json and use environment variables instead.
- Regenerate recommendations after package managers, frameworks, or build tools change.
Avoid
- Do not approve broad Bash wildcards without checking whether each command can write or delete data.
- Do not include commands for package managers that are not used by the repository.
- Do not commit generated settings before a human reviews the permission scope.
Frequently Asked Questions
Does this skill change my settings file?
Can it detect every framework in a repository?
Why does it inspect package manager files?
Should I accept every suggested Bash permission?
Does it support Sentry projects?
Can Codex use this skill?
Developer Details
Author
getsentryLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Repository
https://github.com/getsentry/skills/tree/main/plugins/sentry-skills/skills/claude-settings-auditRef
30c73eac2afe762f6aa9c4553158769369d47351
Maintenance freshness
7/18/2026
Usage
5 downloads · 377 views
File structure
📄 SKILL.md