settings — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited settings (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
CRITICAL: This skill uses AskUserQuestion for every choice. NEVER ask the user questions as plain text.Script paths: nyann is a Claude Code plugin. Plugin root is two levels above this SKILL.md (<plugin_root>/skills/settings/SKILL.md). All scripts live at <plugin_root>/bin/.
Run bash <plugin_root>/bin/setup.sh --check --json. If status != "configured", hand off to the setup skill — settings edits a file that doesn't exist yet.
If the user typed /nyann:settings <key> <value> (or otherwise gave both a key and a value in natural language), skip the menu and run:
bash <plugin_root>/bin/settings.sh --set <key> <value>Surface the one-line confirmation and stop. No further prompts.
Run bash <plugin_root>/bin/settings.sh --show and render the output as a markdown table:
| Setting | Value |
|----------------------------------|-----------------------------|
| Default profile | auto-detect |
| Branching strategy | auto-detect |
| Commit format | conventional-commits |
| GitHub CLI | enabled |
| Documentation storage | local |
| Auto-sync team profiles | off |
| Session triage | enabled |
| Guard severity (default) | advisory |
| CI sentinel notifications | enabled |
| Staleness alerts | enabled |
| Git identity | Name <email> |Call AskUserQuestion with options listing each setting. Add a final "Done — no changes" option:
AskUserQuestion caps the options array at 4 entries per question, so present the picker in two passes: first ask the user which group of settings to explore, then ask which specific setting in that group to change.
Pass 1 — group picker:
{
"questions": [
{
"question": "Which group of settings would you like to change?",
"header": "Group",
"multiSelect": false,
"options": [
{ "label": "Core (profile, branching, commits, GitHub CLI)", "description": "Day-to-day defaults" },
{ "label": "Documentation + team sync", "description": "Docs storage, auto-sync of team profile sources" },
{ "label": "Proactive features (triage, guards, notifications)", "description": "Awareness + monitoring toggles" },
{ "label": "Done — no changes", "description": "Exit without writing" }
]
}
]
}Pass 2 — based on the group, ask the specific setting:
Core group:
{
"questions": [{
"question": "Which core setting would you like to change?",
"header": "Setting",
"multiSelect": false,
"options": [
{ "label": "Default profile", "description": "Stack-aware preference for which profile to apply" },
{ "label": "Branching strategy", "description": "github-flow | gitflow | trunk-based | auto-detect" },
{ "label": "Commit format", "description": "conventional-commits | custom" },
{ "label": "GitHub CLI", "description": "enabled | disabled (branch protection, PR helpers)" }
]
}]
}Documentation + team sync group:
{
"questions": [{
"question": "Which documentation / team-sync setting?",
"header": "Setting",
"multiSelect": false,
"options": [
{ "label": "Documentation storage", "description": "local | obsidian | notion" },
{ "label": "Auto-sync team profiles", "description": "Auto-sync team profile sources during bootstrap" }
]
}]
}Proactive features group:
{
"questions": [{
"question": "Which proactive-feature toggle?",
"header": "Setting",
"multiSelect": false,
"options": [
{ "label": "Session triage", "description": "Quiet drift check on first message each session" },
{ "label": "Guard severity (default)", "description": "advisory | confirm — pre-action guard severity floor" },
{ "label": "CI sentinel notifications", "description": "Sentinel state-change notifications" },
{ "label": "Staleness alerts", "description": "Documentation staleness alerts" }
]
}]
}(If the user expressed interest in a specific setting in their initial message — e.g., "toggle triage" — go straight to that setting's value picker without showing the group menu.)
Once the user picks a setting, call AskUserQuestion with the valid values for that setting (see bin/settings.sh for the enums). Example for Session triage:
{
"questions": [
{
"question": "Enable session-start drift triage?",
"header": "Session triage",
"multiSelect": false,
"options": [
{ "label": "Enabled (Recommended)", "description": "Quiet drift check on first message each session" },
{ "label": "Disabled", "description": "Skip the check; rely on /nyann:doctor manually" }
]
}
]
}Map the picker choice to the --set <key> <value> invocation. Key/value table:
| Setting | Key | Values |
|---|---|---|
| Default profile | default_profile | auto-detect or <profile-name> |
| Branching strategy | branching_strategy | auto-detect, github-flow, gitflow, trunk-based |
| Commit format | commit_format | conventional-commits, custom |
| GitHub CLI | gh_integration | true, false |
| Documentation storage | documentation_storage | local, obsidian, notion |
| Auto-sync team profiles | auto_sync_team_profiles | true, false |
| Session triage | session_triage | true, false |
| Guard severity (default) | guard_default_severity | advisory, confirm |
| CI sentinel | notifications.sentinel | true, false |
| Staleness alerts | notifications.staleness_alerts | true, false |
Run:
bash <plugin_root>/bin/settings.sh --set <key> <value>After the write succeeds, show the updated row and call AskUserQuestion once more: "Change another setting?" → If yes, jump to Step 3. If no, print a short confirmation and exit.
surface the error verbatim and re-ask the picker.
git_identity interactively — gitidentity is set once at setup time. Edit it via the direct shortcut: /nyann:settings git_identity.name "Foo Bar".
preferences.json, hand off to thesetup skill instead of trying to construct the file from scratch.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.