Use agent-config-review

Review a coding agent's configuration for access broader than the work needs and give a verdict

Review a coding agent's configuration for access broader than the work needs and give a verdict — SAFE AS CONFIGURED, TIGHTEN BEFORE USE or DO NOT USE — reading what actually wins across every scope (Claude Code user, project, local and managed settings; permission allow/deny/ask lists, defaultMode, sandbox, hooks, plugins, env; .mcp.json; subagent tool lists; Codex sandbox_mode and approval_policy and the profile in use; Cursor and Copilot agent settings), with each finding's file and line, what it lets happen in plain words, and the exact replacement config.

Reach for it when the user asks "is this Claude Code / Codex / Cursor setup safe", "review our .claude/settings.json", "audit our agent permissions", "is Bash(npm:*) OK in the allow list", "check this repo's agent config before we open it", or wants an agent's permissions tightened before use.

Install it

npx skilldrop-cli install agent-config-review                 # Claude Code, your user folder
npx skilldrop-cli install agent-config-review --project       # Claude Code, this repo
npx skilldrop-cli install agent-config-review --ide cursor    # or kiro, codex, antigravity, copilot

It is part of the AI engineering pack: --pack ai-engineering installs it with its neighbours.

It ships scripts, so it needs Python 3 (standard library only, nothing to install). What they may touch is declared in its manifest.

Ask for it

Say it the way you would to a colleague. Requests like these route to it:

"Can you review our .claude/settings.json and .mcp.json before the team starts using Claude Code on this repo?"
"Is my ~/.codex/config.toml safe? I run it with a profile that skips approvals"
"Is Bash(python3:*) in the allow list a problem if we deny curl?"
"Audit the agent permissions in this repo: hooks, sandbox, subagents, the lot"
"This repo we cloned has a SessionStart hook in its Claude settings. Safe to open it?"

Requests like these belong to a different skill, so it shouldn't answer them:

"Which MCP servers should our release loop connect to, and with what token scopes?"
"Threat-model our support agent: it reads tickets, queries the customer DB and can send email"
"Write the policy for which AI coding tools staff may use with client code"

If another skill answers instead, ask for this one by name: "use agent-config-review".

Check what you get

A good result:

The first line is the verdict and names the worst finding in plain words.
The effective setting is reviewed, with the winning scope named; scopes not read are listed under "To confirm".
Every finding has file:line, its effect in one sentence, and replacement config that can be pasted.
Every wildcard allow entry is read as what it can run, and the deny list is tested against it.
Every hook and command-running setting is quoted and judged; none is waved through as "tooling".
Every literal secret says rotate, masked in the reply, never quoted whole.
No invented facts: no package version, publisher, host, scope or script name the input didn't contain; replacement allow entries use only commands the input shows.
No claim about what wasn't read: plugins, git history, user or managed scopes are "To confirm".

See a worked example

python repo tighten

Use something else when

Choosing which MCP servers and token scopes a workflow should have — mcp-pairing
Threat-modelling an agent's design for prompt injection and exfiltration paths — agent-threat-model
Deciding what each subagent should be told and given in a new design — subagent-design
Writing the organisation's rules for AI tools and data — ai-usage-policy
A token already leaked or an agent already did damage — agent-incident-response; review the config after containment

SKILL.md, the instructions the agent reads
Its page on the site
Related: agent-incident-response, agent-threat-model, ai-usage-policy, mcp-pairing, subagent-design

Edit this page on GitHub · View source