Borrowing it
Nothing to install: this file belongs to Rito-w/claude-code-best-practice-zh. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Rito-w/claude-code-best-practice-zh/main/.claude/commands/workflows/best-practice/workflow-claude-settings.mdgit clone --depth 1 https://github.com/Rito-w/claude-code-best-practice-zhWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/rito-w/claude-code-best-practice-zh/workflow-claude-settings)<a href="https://agentmods.dev/commands/rito-w/claude-code-best-practice-zh/workflow-claude-settings"><img src="https://agentmods.dev/badge/commands/rito-w/claude-code-best-practice-zh/workflow-claude-settings.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00011 | $0.03490 |
| Opus 5 | $0.00005 | $0.01745 |
| Sonnet 5 | $0.00002 | $0.00698 |
| Haiku 4.5 | $0.00001 | $0.00349 |
Grade A, and why
workflow-claude-settings scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to workflow-claude-settings — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 244 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Workflow Changelog — Settings Report
You are a coordinator for the claude-code-best-practice project. Your job is to launch two research agents in parallel, wait for their results, merge findings, and present a unified report about drift in the Settings Reference report (best-practice/claude-settings.md).
Versions to check: $ARGUMENTS (default: 10 if empty or not a number)
This is a read-then-report workflow. Launch agents, merge results, and produce a report. Only take action if the user approves.
Phase 0: Launch Both Agents in Parallel
Immediately spawn both agents using the Task tool in the same message (parallel launch):
Agent 1: workflow-claude-settings-agent
Spawn using subagent_type: "workflow-claude-settings-agent". Give it this prompt:
Research the claude-code-best-practice project for settings report drift. Check the last $ARGUMENTS versions (default: 10).
Fetch these 3 external sources:
- Settings Documentation: https://code.claude.com/docs/en/settings
- CLI Reference: https://code.claude.com/docs/en/cli-reference
- Changelog: https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md
Then read the local report file (
best-practice/claude-settings.md) and the CLAUDE.md file. Analyze differences between what the official docs say about settings keys, permission syntax, hook events, MCP configuration, sandbox options, plugin settings, model aliases, display settings, and environment variables versus what our report documents. Return a structured findings report covering missing settings, changed types/defaults, new settings additions, deprecated settings, permission syntax changes, hook event changes, MCP setting changes, sandbox setting changes, environment variable completeness, example accuracy, settings hierarchy accuracy, and sources validity.
Agent 2: claude-code-guide
Spawn using subagent_type: "claude-code-guide". Give it this prompt:
Research the latest Claude Code settings system. I need you to find:
- The complete list of all currently supported settings.json keys with their types, defaults, and descriptions
- Any new settings keys introduced in recent Claude Code versions
- Changes to existing settings behavior (e.g. new permission modes, new hook events, new sandbox options)
- Changes to the settings hierarchy (new priority levels, new file locations)
- Changes to permission syntax (new tool patterns, new wildcard behavior)
- New hook events or changes to hook configuration structure
- Changes to MCP server configuration (new matching fields, new settings)
- Changes to sandbox settings (new network options, new commands)
- Changes to plugin configuration (new fields, new marketplace options)
- Changes to environment variables (new vars, deprecated vars, changed behavior)
- Changes to model aliases or model configuration
- Changes to display/UX settings (status line, spinners, progress bars)
- Any deprecations or removals of settings keys
Be thorough — search the web, fetch docs, and provide concrete version numbers and details for everything you find.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 244 lines · 11 tokens per session scan A 818e5e1661cf
workflow-claude-settings is a command published in the GitHub repository Rito-w/claude-code-best-practice-zh (10 stars, last pushed 2mo ago), licensed MIT. It adds 11 tokens to every session and 3,490 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. It is 100% identical to workflow-claude-settings, differing in 0 lines, and is treated as a copy.
Other commands, from other repositories
checklist
Generate a custom checklist for the current feature based on user requirements.
clarify
Identify underspecified areas in the current feature spec by asking up to 5 highly targeted clarification questions and encoding answers back into the spec.
specify
Create or update the feature specification from a natural language feature description.
converge
Assess the current codebase against the feature's spec, plan, and tasks, then append any remaining unbuilt work as new tasks to tasks.md so implement can complete it.
implement
Execute the implementation plan by processing and executing all tasks defined in tasks.md.
analyze
Perform a non-destructive cross-artifact consistency and quality analysis across spec.md, plan.md, and tasks.md after task generation.