Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed local AI-CLI inventory scanner that checks auth/config signals and writes a local cache, with no evidence of secret exfiltration or destructive behavior.
Install this only if you are comfortable with a skill checking which AI CLIs are on your machine, whether their auth/config files or API-key environment variables exist, running small model probes unless you request a quick scan, and saving the resulting local inventory under ~/.claude/model-inventory.json for other skills to use.
claude) cfg_model "$HOME/.claude/settings.json" "~/.claude/settings.json" && return ;;
codex)
if [ -f "$HOME/.codex/config.toml" ]; then
m=$(grep -E '^[[:space:]]*model[[:space:]]*=' "$HOME/.codex/config.toml" 2>/dev/null | head -n 1 | sed -e 's/.*=[[:space:]]*//' -e 's/^"//' -e 's/"[[:space:]]*$//')
if [ -n "$m" ]; then printf '%s|model= in ~/.codex/config.toml' "$m"; return; fi
fi ;;
esaccase $1 in
opencode) cfg_model "$HOME/.config/opencode/opencode.json" "~/.config/opencode/opencode.json" && return ;;
qwen) cfg_model "$HOME/.qwen/settings.json" "~/.qwen/settings.json" && return ;;
gemini) cfg_model "$HOME/.gemini/settings.json" "~/.gemini/settings.json" && return ;;
copilot) cfg_model "$HOME/.copilot/config.json" "~/.copilot/config.json" && return ;;
claude) cfg_model "$HOME/.claude/settings.json" "~/.claude/settings.json" && return ;;
codex)case $1 in
opencode) cfg_model "$HOME/.config/opencode/opencode.json" "~/.config/opencode/opencode.json" && return ;;
qwen) cfg_model "$HOME/.qwen/settings.json" "~/.qwen/settings.json" && return ;;
gemini) cfg_model "$HOME/.gemini/settings.json" "~/.gemini/settings.json" && return ;;
copilot) cfg_model "$HOME/.copilot/config.json" "~/.copilot/config.json" && return ;;
claude) cfg_model "$HOME/.claude/settings.json" "~/.claude/settings.json" && return ;;
codex)qwen) cfg_model "$HOME/.qwen/settings.json" "~/.qwen/settings.json" && return ;;
gemini) cfg_model "$HOME/.gemini/settings.json" "~/.gemini/settings.json" && return ;;
copilot) cfg_model "$HOME/.copilot/config.json" "~/.copilot/config.json" && return ;;
claude) cfg_model "$HOME/.claude/settings.json" "~/.claude/settings.json" && return ;;
codex)
if [ -f "$HOME/.codex/config.toml" ]; then
m=$(grep -E '^[[:space:]]*model[[:space:]]*=' "$HOME/.codex/config.toml" 2>/dev/null | head -n 1 | sed -e 's/.*=[[:space:]]*//' -e 's/^"//' -e 's/"[[:space:]]*$//')qwen) cfg_model "$HOME/.qwen/settings.json" "~/.qwen/settings.json" && return ;;
gemini) cfg_model "$HOME/.gemini/settings.json" "~/.gemini/settings.json" && return ;;
copilot) cfg_model "$HOME/.copilot/config.json" "~/.copilot/config.json" && return ;;
claude) cfg_model "$HOME/.claude/settings.json" "~/.claude/settings.json" && return ;;
codex)
if [ -f "$HOME/.codex/config.toml" ]; then
m=$(grep -E '^[[:space:]]*model[[:space:]]*=' "$HOME/.codex/config.toml" 2>/dev/null | head -n 1 | sed -e 's/.*=[[:space:]]*//' -e 's/^"//' -e 's/"[[:space:]]*$//')copilot) cfg_model "$HOME/.copilot/config.json" "~/.copilot/config.json" && return ;;
claude) cfg_model "$HOME/.claude/settings.json" "~/.claude/settings.json" && return ;;
codex)
if [ -f "$HOME/.codex/config.toml" ]; then
m=$(grep -E '^[[:space:]]*model[[:space:]]*=' "$HOME/.codex/config.toml" 2>/dev/null | head -n 1 | sed -e 's/.*=[[:space:]]*//' -e 's/^"//' -e 's/"[[:space:]]*$//')
if [ -n "$m" ]; then printf '%s|model= in ~/.codex/config.toml' "$m"; return; fi
fi ;;claude) cfg_model "$HOME/.claude/settings.json" "~/.claude/settings.json" && return ;;
codex)
if [ -f "$HOME/.codex/config.toml" ]; then
m=$(grep -E '^[[:space:]]*model[[:space:]]*=' "$HOME/.codex/config.toml" 2>/dev/null | head -n 1 | sed -e 's/.*=[[:space:]]*//' -e 's/^"//' -e 's/"[[:space:]]*$//')
if [ -n "$m" ]; then printf '%s|model= in ~/.codex/config.toml' "$m"; return; fi
fi ;;
esacauth_claude() {
if [ -n "${ANTHROPIC_API_KEY:-}" ]; then printf 'likely-authenticated|env ANTHROPIC_API_KEY is set'; return; fi
if [ -f "$HOME/.claude/.credentials.json" ]; then printf 'likely-authenticated|~/.claude/.credentials.json exists'; return; fi
if [ -f "$HOME/.claude.json" ] && grep -q '"oauthAccount"' "$HOME/.claude.json" 2>/dev/null; then
printf 'likely-authenticated|oauthAccount present in ~/.claude.json'; return
fiauth_claude() {
if [ -n "${ANTHROPIC_API_KEY:-}" ]; then printf 'likely-authenticated|env ANTHROPIC_API_KEY is set'; return; fi
if [ -f "$HOME/.claude/.credentials.json" ]; then printf 'likely-authenticated|~/.claude/.credentials.json exists'; return; fi
if [ -f "$HOME/.claude.json" ] && grep -q '"oauthAccount"' "$HOME/.claude.json" 2>/dev/null; then
printf 'likely-authenticated|oauthAccount present in ~/.claude.json'; return
fi1. **Tiers 1–2 — run the scan.** Execute `scripts/scan.sh` (bash; runs on Git Bash/macOS/Linux) and show the user the per-CLI result. Zero tokens spent, nothing sent anywhere. 2. **Tier 3 — probe, unless the user said "quick scan".** For each installed CLI, run the probe command from [references/cli-registry.md](references/cli-registry.md) once per seed model (claude: all four aliases; other CLIs: `default` only) and classify by the table there: `verified` / `unavailable` / `blocked-by-auth` / `quota-exhausted` / `unknown`. A login error flips the CLI's `auth.status` to `unauthenticated` and marks all its models `blocked-by-auth` — the "installed but account not active" case, with the error line quoted. A timeout is `unknown`, never `unavailable`. One attempt per model; retry once only after changing one named thing; second failure → record `unknown` with the quoted error and move on. Ollama needs no probe — `ollama list` already verified its models locally. 3. **Build the routing table** per the rules below, from probe results only. 4. **Write `~/.claude/model-inventory.json`** (schema below), then report: a per-CLI table (version, auth status, each model's status with evidence), what was probed vs. assumed, and total probe cost. Zero usable CLIs is a valid outcome — write the inventory anyway so consumers see an honest empty rather than a missing file. ## Routing rules
No suspicious patterns detected.