n4m3z/SettingsMaintenance
skills/SettingsMaintenance/SKILL.md
Audit and clean AI coding tool settings — permissions, plugins, hooks, cross-layer conflicts. USE WHEN review permissions, clean settings, audit config, plugin conflicts, hook audit, settings cruft.
$ install --global
skillsauthnpx skillsauth add n4m3z/forge-core SettingsMaintenanceInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 28, 2026, 6:16 AM38.4s6 files scanned
SKILL.md
- name:
- SettingsMaintenance
- version:
- 0.1.0
- description:
- Audit and clean AI coding tool settings — permissions, plugins, hooks, cross-layer conflicts. USE WHEN review permissions, clean settings, audit config, plugin conflicts, hook audit, settings cruft.
SettingsMaintenance
Audit and clean AI coding tool settings files. Covers permission entries, plugin configuration, hook wiring, and cross-layer conflicts.
Settings Architecture
AI coding tools layer settings across multiple files. Claude Code uses 4 files with inheritance:
| Layer | File | Committed | Scope |
|----------------|-----------------------------------|-----------------|--------------------------------------------------|
| Global shared | ~/.claude/settings.json | No (personal) | All projects |
| Global local | ~/.claude/settings.local.json | No (personal) | All projects, overrides global shared |
| Project shared | .claude/settings.json | Yes (git) | This project, shared with collaborators |
| Project local | .claude/settings.local.json | No (gitignored) | This project, personal overrides |
Precedence (highest wins): project local > project shared > global local > global shared.
At the global level, both files are personal — the settings.json / settings.local.json split is redundant. The local file is designed for project-level use where settings.json is committed and settings.local.json holds personal overrides.
Workflow Routing
| Subskill | Trigger | Content | |-------------------|------------------------------------------------------------|------------------------| | ClaudePermissions | "permissions", "allowed commands", "settings cruft" | @ClaudePermissions.md | | ClaudePlugins | "plugins", "plugin conflicts", "disable plugins" | @ClaudePlugins.md | | ClaudeHooks | "hooks", "hook config", "dispatch" | @ClaudeHooks.md | | ClaudeBaseline | "baseline", "global settings", "user scope", "bootstrap" | @ClaudeBaseline.md | | GeminiSettings | "gemini settings", "audit gemini" | @GeminiSettings.md | | Full audit | "full audit", "review settings", "clean everything" | All of the above |
Common Procedure
All subskills follow this 6-phase workflow:
- Scope — Determine which settings layers to audit. Default: all 4 files that exist. User can narrow to "just global" or "just project".
- Inventory — Read each file. Count entries by category. Present a summary table with totals.
- Audit — Run the subskill's checks against the inventory. Collect findings.
- Report — Present findings grouped by category. Each finding: ID, category, severity (remove/consolidate/flag), entry, reason.
- Apply — On user approval, edit files. Apply changes per-category so user can approve/reject each group independently. Use targeted Edit tool calls for reviewable diffs.
- Verify —
jq . <file> > /dev/nullfor JSON validity. Count before/after entries. Spot-check that critical tools remain permitted.
Cross-Layer Checks
Run these regardless of which subskill is active:
| Check | What to look for |
|------------------------------------|-------------------------------------------------------------------------------------------|
| Env var duplication | Same key+value in both global and project settings.json — project inherits from global |
| Permission scattering | Same entry in both settings.json and settings.local.json at the same level |
| Plugin enable/disable conflict | Global disables a plugin but project re-enables it (or vice versa) |
| Redundant local file | At global level, settings.local.json entries that already exist in settings.json |
Sources
- https://docs.anthropic.com/en/docs/claude-code
Related Skills
n4m3z/Wtf
development
VerifiedTrustedCommunity
Reactive correction and root-cause fix. USE WHEN something went wrong, user is frustrated, demands a correction, says wtf, what the hell, why did you, that's wrong, this is broken, no not that, stop. Executes the immediate fix, then hunts the upstream artifact that caused it and creates a corrective change.
4SKILL.mdUpdated May 28, 2026
n4m3z/ResearchTopic
development
VerifiedTrustedCommunity
Decompose a research question into sub-queries, spawn parallel WebResearcher agents per angle, synthesize findings with citations and explicit confidence. USE WHEN the user asks to research, investigate, look online, look up, dig into, find sources, gather evidence, or survey what's known about a topic. Single-pass; for multi-round adversarial research use ResearchCouncil in forge-council.
4SKILL.mdUpdated May 27, 2026
n4m3z/WriteDocs
tools
VerifiedTrustedCommunity
Author project documentation that future humans (and AI sessions) actually read. Covers TLDRs for tools, READMEs, runbooks, journals. USE WHEN write documentation, create tldr, tool one-pager, document a cli, write readme, runbook, journal entry, capture knowledge about a tool, distill a session into reusable notes.
4SKILL.mdUpdated May 25, 2026
n4m3z/StagedReview
development
VerifiedTrustedCommunity
Review your own staged changes via a code-review TUI before triggering a commit. USE WHEN about to commit, walking through your own staged diff, self-reviewing before approval, tuicr, revdiff, git diff cached.
4SKILL.mdUpdated May 25, 2026