Claude Setup Audit — Security skill for Claude Code

Setup Audit for Claude Code

An evidence-backed auditor for your **whole** Claude Code setup. It reads your user and per-project settings, permissions, hooks, MCP servers, skills, plugins, CLAUDE.md files, memory, and usage and transcript data, and compares them with the **current** official docs. You get a short, ranked list of fixes for:

• Security: risky standing permissions, secrets baked into rules, missing deny rules, broken hooks, sandbox gaps.
• Cost & context: your measured per-session context baseline, oversized CLAUDE.md files, unused MCP servers, skill-listing overflow, model and compaction settings, and prompt-cache health (hit ratio, 1-hour vs 5-minute cache writes, and mid-session cache rewrites classified by cause: idle gap, model switch, compaction).
• Learning from repeated mistakes: recurring friction and corrections across sessions and projects, turned into the lightest mechanism that stops them (memory → rule → hook → skill), and re-measured on the next run.
• Agent readiness (opt-in: focus=readiness): whether Claude can set up, run, verify and understand each repo cheaply. See Agent readiness below.

Proposals are applied only when you approve them, with backups and verification.

Install

/plugin marketplace add senzelden/claude-setup-audit
/plugin install setup-audit@claude-setup-audit

Use

Ask naturally ("audit my Claude Code setup", "why is Claude Code so expensive?") or invoke it directly:

/setup-audit:setup-audit focus=security depth=quick mode=audit

Option	Values	Default
focus	security, cost, learning, readiness, or weights such as cost:2,readiness:1	equal; readiness opt-in
depth	quick (local snapshot only) · full (plus docs diff and what's new)	full
scope	global · project · all	all
mode	audit (read-only) · propose (report + diffs, then ask) · apply	propose
`