What problem does it solve? Toolguard and Claude Code permission configurations can silently accumulate over-broad allow rules, broken takeover-mode setups, and unregistered hooks that leave a project ungoverned. This Skill audits the entire config hierarchy and flags those risks before they become security holes. ## Core Features & Use Cases - Deterministic analysis: Runs the tested toolguard-audit Python analyzer to mechanically flag dangerous allow patterns and takeover-mode invariant violations with CRITICAL/HIGH/MEDIUM/LOW severities. - Optional AI-assisted assessment: On user approval, performs a judgement-based review of the consolidated config context to catch combinational escapes, over-broad globs, and missing hardening that deterministic detectors cannot see. - Structured remediation proposals: Emits machine-appliable EditProposal fixes alongside human-readable remediation text, while remaining strictly read-only and never editing config files. - Use Case: At the start of a session, ask for a security check of your project's toolguard setup to discover that a blanket Bash(curl:*) allow or an unregistered hook is silently disabling governance. ## Quick Start Ask the assistant to run a security audit of the toolguard permission configuration in the current project and report any risky allow rules.
