agent-config-auditlisted

# Agent Config Audit ## Authorized Scope Apply this engine only within the user's requested task and existing explicit authorization. Loading or delegating to it grants no additional authority. Preserve report-only restrictions and the caller's target, host, provider, and cost limits. Existing approval satisfies a gate only for the same actions and scope; obtain approval before expanding them. Forward these limits to delegates. ## Contract Inputs: - Workspace root - Scope: full, dedup, stale, instructions, cursor, settings, or fix - Optional list of repos/config files to include Outputs: - Audit report with critical/moderate/minor findings - Proposed fix plan - Applied changes only when fix mode is explicit Creates/Modifies: - Report mode: no file changes - Fix mode: agent config files, `.agents/` docs, and related settings, but only after an explicit fix request and confirmation of the exact plan External Side Effects: - None by default - Does not push, publish, or call external APIs Confirmation Required: - Before entering fix mode or using any mutating file/shell operation; an audit or sync request alone authorizes report mode only - Before overwriting existing agent configs - Before deleting or consolidating duplicated rules Delegates To: - `rules-capture` for single new preferences - `agent-folder-init` for missing `.agents/` structure ## When to Use - User mentions: "audit CLAUDE.md", "agent config", "rules out of date", "config drift", "sync docs"