configuration-scan

Analyzes how software is configured, tracing sources, precedence, defaults, secrets plumbing, and validation.

3|1|Updated Aug 26, 2026
One-click install
npx skills add https://github.com/zeljkoobrenovic/sokrates-skills --skill configuration-scan-zeljkoobrenovic
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: configuration-scan
Source: https://github.com/zeljkoobrenovic/sokrates-skills/tree/main/skills/scanners/configuration-scan
Command: npx skills add https://github.com/zeljkoobrenovic/sokrates-skills --skill configuration-scan-zeljkoobrenovic

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve? A program's configuration system — its sources, precedence order, defaults, and failure behavior — is rarely documented as a whole, so operators set values that silently lose to another source, rely on defaults nobody wrote down, or ship secrets through plumbing nobody traced. This Skill reconstructs that system from the code and reports it as verifiable findings. ## Core Features & Use Cases - Source and precedence reconstruction: Inventories config files, environment variables, CLI flags, profiles, and remote settings, then reads the loader to state exactly how they merge and which source wins. - Settings surface audit: Counts the configurable settings by area, cross-checks code against documentation, and flags undocumented settings the code reads and stale settings the docs promise but the code ignores. - Secrets plumbing and validation review: Traces how credentials travel from env vars, key files, keychains, or vaults into clients, and reports how bad or missing configuration is validated and handled at startup versus first use. - Use Case: Point it at a repository with a Sokrates analysis and ask how the application is configured; it produces a structured findings report (sources, precedence, defaults, feature flags, reload behavior) rendered into an interactive HTML explorer. ## Quick Start Ask the AI to run the configuration scan on this repository and report where each setting comes from, which source wins, and what happens when configuration is missing or invalid.

Frequently Asked Questions about configuration-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit how an application is configured?

Run this scanner against the repository, ideally with a Sokrates _sokrates analysis present. It inventories every configuration source, reads the loader to determine precedence and merge rules, and writes findings covering defaults, validation, secrets plumbing, and feature flags.

How to find undocumented settings and stale config keys in code?

The scanner greps each setting key against the documentation and reports counts of keys the code reads but docs never mention, plus documented keys the code never reads. Only settings that are dangerous when wrong are named individually; the rest are reported as counts with the method stated.

Does the configuration scan work without a Sokrates analysis?

Yes, it degrades gracefully without a _sokrates folder, though it works best with one. The bundled count_config_sites.py script scans the source tree directly for env-var reads, CLI flags, config loads, and validation sites using only the Python standard library.

What is the difference between configuration-scan and security-scan for secrets?

This scanner owns the plumbing: which sources supply credentials, how a secret travels from source to client, redaction mechanisms, and operator setup steps. The security-scan sibling owns the protection verdict, such as whether a credential leaks or is adequately protected, and this scanner references those findings rather than re-rating them.

Why does the script warn about few flag names extracted from many declarations?

The script resolves flag and env-var names only from same-file string constants, so names assembled at runtime or declared in another file stay invisible. When it warns, read the option declaration sites directly and rebuild the settings surface by hand.