Reviewing Runtime Configuration

Settings and hooks are one trust surface: together they decide what runs on a developer's machine without a permission prompt. Hooks are often declared inside settings.json rather than a separate hooks.json, so reviewing one means checking the other.

Scope, severity, and output format come from ../reviewing-claude-config/SKILL.md. Report only what the changeset introduced or worsened — the fence is stated there.

Prefer being reached through that router rather than directly: it runs an always-on secret scan before routing and a filter afterwards, and neither happens on a direct invocation. If you were invoked directly, run the secret scan yourself using the patterns in ../reviewing-claude-config/reference/security-patterns.md, as Grep queries rather than the shell commands a read-only grant cannot execute, and say in the findings that the filter did not run. For permission-rule syntax and settings conventions, see ../reviewing-claude-config/reference/claude-code-requirements.md.