Rc Audit

Config Audit

Treat the agent's configuration as an attack surface. Hooks, MCP servers, permission allowlists, and skill/agent prompts run with the user's privileges and often ingest untrusted content — a poisoned hook in a cloned repo, an unpinned MCP package, an over-broad Bash(*) allow, or a prompt-injection payload hidden in a skill can all turn the agent against its operator. This skill scans that surface and reports what to fix, ranked by real risk. It is read-only — it diagnoses, it does not change config.

Required Inputs

• None required. Defaults to auditing the current repository's config surface plus the user-scope config it can resolve.
• Optional: an explicit config root to scope the audit (e.g. a project dir, ~/.claude, ~/.config/opencode).

Scope — what to read

Discover and read whatever exists; skip silently what does not:

• Claude Code: .claude/settings.json, .claude/settings.local.json, ~/.claude/settings.json, .claude/hooks/**, .claude/rc/hooks/**, .claude/agents/**, .claude/skills/**, .mcp.json, CLAUDE.md.
• OpenCode: .opencode/** (agents, commands, plugins), ~/.config/opencode/**.
• Cursor / others: .cursor/** (rules, hooks, mcp), AGENTS.md, and any *mcp*.json.
• The rc-managed hooks under hooks/scripts/** if auditing the rc repo itself.

Read each file completely before judging it. Use Grep to sweep for the patterns below across the whole config tree.

Audit checklist

Evaluate every finding against real exploitability in this setup, not theory. Assign severity critical | high | medium | low.

1. Hardcoded secrets — API keys, tokens, passwords, private keys in settings/mcp/env/agent files. Look for high-entropy strings, sk-, ghp_, AKIA, -----BEGIN * PRIVATE KEY-----, Bearer , password=. critical.
2. Over-broad permissions — Bash(*), Bash(:*), unrestricted Read/Write/WebFetch, or a missing permissions.deny for sensitive paths (~/.ssh, ~/.aws, **/.env*, ~/.config/**). high.
3. Dangerous hooks — hook commands that pipe to a shell (curl … | bash, wget … | sh), interpolate untrusted fields unquoted (${file}, $CLAUDE_* into a command), run destructive ops (rm -rf, git reset --hard), or fetch+execute remote code. Hooks that exit non-fail-open. critical/high.
4. MCP supply-chain risk — MCP servers launched via npx -y / uvx / pip install without a pinned version, pointing at unknown registries, or with broad filesystem/network scope. Unpinned = high.
5. Prompt-injection vectors in prompts — skills/agents/rules containing hidden-Unicode (zero-width, bidi overrides), HTML comments with directives, or text instructing the agent to ignore prior instructions / exfiltrate / auto-approve. Third-party (non-bundled) skills are higher risk. high.
6. Silent error suppression — config or hook commands using 2>/dev/null, || true, or swallowing failures in a way that hides a security control failing open when it should fail closed. medium.
7. Excessive autonomy / weak gates — auto-approve settings, disabled confirmations on outward-facing writes, --dangerously-skip-permissions-style flags, or MCP tools with write/exec scope enabled by default. high.
8. Tool/context bloat — many MCP servers always-on (each ~hundreds of tokens of tool schema) inflating attack surface and context. low (note, don't over-weight).

Report

Write to .rc/audit/config-audit-NNN.md (zero-padded, increments past existing) and print the same content. If .rc/ cannot be resolved, write to ./config-audit-NNN.md.

Open with a grade and category summary:

CONFIG AUDIT — Grade: B   (A clean · F critical exposure)
================================================
Secrets:          [OK / N findings]
Permissions:      [OK / N findings]
Hooks:            [OK / N findings]
MCP supply-chain: [OK / N findings]
Prompt-injection: [OK / N findings]
Error handling:   [OK / N findings]
Autonomy/gates:   [OK / N findings]
Tool/context:     [OK / N findings]

Grade heuristic: F any critical; D ≥1 high + many medium; C a few high; B only medium/low; A clean.

Then one block per finding:

issue (blocking) [secrets]: 
  file:line — 
  fix: 
  severity: critical

Also emit a machine-readable findings block (SARIF-like) for CI consumption:

{
  "tool": "rc-audit",
  "grade": "B",
  "findings": [
    { "ruleId": "secrets/hardcoded-key", "level": "error", "severity": "critical",
      "location": { "file": ".mcp.json", "line": 12 }, "message": "…", "fix": "…" }
  ]
}

Use level = error (critical/high) | warning (medium) | note (low). Close with the report path and, if any critical/high remain, the single most important fix to do first.

Confidence & false positives

Only report a finding you are >80% sure is a real, exploitable risk in this setup. Skip: example/placeholder secrets clearly marked as such (.env.example, `); permission breadth that is scoped by a matching deny; npx -y that *is* pinned (pkg@1.2.3); a hook's 2>/dev/null on a genuinely non-security path. A clean config graded A` with zero findings is a valid, expected result.

Critical Rules

• Read-only. Never edit config, never rotate/remove secrets yourself — report them and recommend rotation (a committed secret is already compromised; recommend revoking it).
• Never print a discovered secret's full value in the report — redact to the last 4 chars.
• Judge by exploitability in this setup; do not pad the report. Apply the confidence threshold to every finding.
• This is a config audit, not a code review or a CVE scan — route those elsewhere.

Error Handling

• If no config files can be found, say so and stop — there is nothing to audit.
• If a file cannot be parsed (malformed JSON), report it as a finding (a broken settings file is itself a risk) and continue.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: rodolfochicone
• Source: rodolfochicone/rc-project
• License: MIT
• Homepage: https://rodolfochicone.dev

Install and usage instructions live in the source repository linked above.