Askit Build Settings
Creates and improves a plugin's settings and permissions per target and recommends least-privilege allowlists. Use when authoring settings, scoping permissions, wiring environment variables, or registering hooks in settings.
Install
$ agentstack add skill-product-on-purpose-agent-skills-toolkit-askit-build-settings ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
askit-build-settings
Purpose
Author and improve a plugin's settings and permissions, following the builder pattern ([../../docs/reference/builder-pattern.md](../../docs/reference/builder-pattern.md)). create scaffolds the settings per target (Claude Code settings.json - permissions, env, hook registration; Codex config.toml for the subset it supports); improve tightens an existing one. It also folds in permission advice: recommend the least-privilege allowlist a plugin needs, never broader (Standard sec 9). Recipe and the permission rubric are in [references/settings-recipe.md](references/settings-recipe.md).
When to use
When authoring settings, scoping permissions, wiring environment variables, or registering hooks in settings.
create mode
- Read what the plugin actually needs (which tools, which paths, which env, which hooks).
- Scaffold the settings per target: Claude Code
settings.json(apermissionsallow/deny set,env, andhooksregistration); Codexconfig.tomlfor the subset it supports. - Apply least privilege: the allowlist grants only what a component uses; secrets go through
envindirection, never committed (sec 9).
improve mode
- Read the current settings and the components; remove any granted permission no component uses, and tighten an over-broad matcher.
permission advice
- For a given component or plugin, recommend the minimal allowlist (the narrowest tool set and path scope it needs) and flag any over-grant. This is the
permission-advisorrole, folded in as a mode rather than a separate skill.
Scope
Settings are partly cross-agent: Claude Code settings.json is the rich surface; Codex config.toml supports a subset. Least privilege and secret hygiene are Universal security rules (sec 9). Hook authoring itself is askit-build-hook; this skill wires a hook's registration entry. Status line registration is askit-build-statusline.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: product-on-purpose
- Source: product-on-purpose/agent-skills-toolkit
- License: Apache-2.0
- Homepage: https://product-on-purpose.github.io/agent-skills-toolkit
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.