{
  "meta": {
    "target": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium",
    "timestamp": "2026-05-01T14:44:16.877Z",
    "version": "2.2.0",
    "tool": "config-audit"
  },
  "scanners": [
    {
      "scanner": "CML",
      "status": "ok",
      "files_scanned": 1,
      "duration_ms": 2,
      "findings": [],
      "counts": {
        "critical": 0,
        "high": 0,
        "medium": 0,
        "low": 0,
        "info": 0
      }
    },
    {
      "scanner": "SET",
      "status": "ok",
      "files_scanned": 1,
      "duration_ms": 1,
      "findings": [],
      "counts": {
        "critical": 0,
        "high": 0,
        "medium": 0,
        "low": 0,
        "info": 0
      }
    },
    {
      "scanner": "HKV",
      "status": "ok",
      "files_scanned": 1,
      "duration_ms": 1,
      "findings": [],
      "counts": {
        "critical": 0,
        "high": 0,
        "medium": 0,
        "low": 0,
        "info": 0
      }
    },
    {
      "scanner": "RUL",
      "status": "skipped",
      "files_scanned": 0,
      "duration_ms": 0,
      "findings": [],
      "counts": {
        "critical": 0,
        "high": 0,
        "medium": 0,
        "low": 0,
        "info": 0
      }
    },
    {
      "scanner": "MCP",
      "status": "ok",
      "files_scanned": 1,
      "duration_ms": 0,
      "findings": [],
      "counts": {
        "critical": 0,
        "high": 0,
        "medium": 0,
        "low": 0,
        "info": 0
      }
    },
    {
      "scanner": "IMP",
      "status": "ok",
      "files_scanned": 1,
      "duration_ms": 0,
      "findings": [],
      "counts": {
        "critical": 0,
        "high": 0,
        "medium": 0,
        "low": 0,
        "info": 0
      }
    },
    {
      "scanner": "CNF",
      "status": "ok",
      "files_scanned": 2,
      "duration_ms": 1,
      "findings": [],
      "counts": {
        "critical": 0,
        "high": 0,
        "medium": 0,
        "low": 0,
        "info": 0
      }
    },
    {
      "scanner": "GAP",
      "status": "ok",
      "files_scanned": 4,
      "duration_ms": 2,
      "findings": [
        {
          "id": "CA-GAP-001",
          "scanner": "GAP",
          "severity": "medium",
          "title": "No custom skills or commands",
          "description": "Feature gap: No custom skills or commands. Create project-specific skills in .claude/skills/ or commands in .claude/commands/ to automate repetitive workflows.",
          "file": null,
          "line": null,
          "evidence": null,
          "category": "t1",
          "recommendation": "Create project-specific skills in .claude/skills/ or commands in .claude/commands/ to automate repetitive workflows.",
          "autoFixable": false
        },
        {
          "id": "CA-GAP-002",
          "scanner": "GAP",
          "severity": "low",
          "title": "Settings only at one scope",
          "description": "Feature gap: Settings only at one scope. Use all 3 settings scopes: ~/.claude/settings.json (user), .claude/settings.json (project), .claude/settings.local.json (local/personal).",
          "file": null,
          "line": null,
          "evidence": null,
          "category": "t2",
          "recommendation": "Use all 3 settings scopes: ~/.claude/settings.json (user), .claude/settings.json (project), .claude/settings.local.json (local/personal).",
          "autoFixable": false
        },
        {
          "id": "CA-GAP-003",
          "scanner": "GAP",
          "severity": "low",
          "title": "No path-scoped rules",
          "description": "Feature gap: No path-scoped rules. Create .claude/rules/*.md with paths: frontmatter to apply rules only to matching files.",
          "file": null,
          "line": null,
          "evidence": null,
          "category": "t2",
          "recommendation": "Create .claude/rules/*.md with paths: frontmatter to apply rules only to matching files.",
          "autoFixable": false
        },
        {
          "id": "CA-GAP-004",
          "scanner": "GAP",
          "severity": "low",
          "title": "Low hook diversity",
          "description": "Feature gap: Low hook diversity. Use hooks across 3+ events (e.g., SessionStart, PreToolUse, Stop) for comprehensive automation.",
          "file": null,
          "line": null,
          "evidence": null,
          "category": "t2",
          "recommendation": "Use hooks across 3+ events (e.g., SessionStart, PreToolUse, Stop) for comprehensive automation.",
          "autoFixable": false
        },
        {
          "id": "CA-GAP-005",
          "scanner": "GAP",
          "severity": "low",
          "title": "No custom subagents",
          "description": "Feature gap: No custom subagents. Create custom agents in .claude/agents/ or ~/.claude/agents/ with specialized tools and model selection.",
          "file": null,
          "line": null,
          "evidence": null,
          "category": "t2",
          "recommendation": "Create custom agents in .claude/agents/ or ~/.claude/agents/ with specialized tools and model selection.",
          "autoFixable": false
        },
        {
          "id": "CA-GAP-006",
          "scanner": "GAP",
          "severity": "low",
          "title": "No model configuration",
          "description": "Feature gap: No model configuration. Set model preferences in settings.json (model, modelOverrides) for cost/quality optimization.",
          "file": null,
          "line": null,
          "evidence": null,
          "category": "t2",
          "recommendation": "Set model preferences in settings.json (model, modelOverrides) for cost/quality optimization.",
          "autoFixable": false
        },
        {
          "id": "CA-GAP-007",
          "scanner": "GAP",
          "severity": "info",
          "title": "No status line configured",
          "description": "Feature gap: No status line configured. Configure statusLine in settings.json to show context window usage, cost, and model info.",
          "file": null,
          "line": null,
          "evidence": null,
          "category": "t3",
          "recommendation": "Configure statusLine in settings.json to show context window usage, cost, and model info.",
          "autoFixable": false
        },
        {
          "id": "CA-GAP-008",
          "scanner": "GAP",
          "severity": "info",
          "title": "No custom keybindings",
          "description": "Feature gap: No custom keybindings. Create ~/.claude/keybindings.json to customize keyboard shortcuts (e.g., bind chat:newline to Shift+Enter).",
          "file": null,
          "line": null,
          "evidence": null,
          "category": "t3",
          "recommendation": "Create ~/.claude/keybindings.json to customize keyboard shortcuts (e.g., bind chat:newline to Shift+Enter).",
          "autoFixable": false
        },
        {
          "id": "CA-GAP-009",
          "scanner": "GAP",
          "severity": "info",
          "title": "Using default output style",
          "description": "Feature gap: Using default output style. Try \"Explanatory\" or \"Learning\" output styles, or create custom styles in .claude/output-styles/.",
          "file": null,
          "line": null,
          "evidence": null,
          "category": "t3",
          "recommendation": "Try \"Explanatory\" or \"Learning\" output styles, or create custom styles in .claude/output-styles/.",
          "autoFixable": false
        },
        {
          "id": "CA-GAP-010",
          "scanner": "GAP",
          "severity": "info",
          "title": "No worktree workflow",
          "description": "Feature gap: No worktree workflow. Use --worktree for parallel feature development. Configure worktree.symlinkDirectories for node_modules.",
          "file": null,
          "line": null,
          "evidence": null,
          "category": "t3",
          "recommendation": "Use --worktree for parallel feature development. Configure worktree.symlinkDirectories for node_modules.",
          "autoFixable": false
        },
        {
          "id": "CA-GAP-011",
          "scanner": "GAP",
          "severity": "info",
          "title": "No advanced skill frontmatter",
          "description": "Feature gap: No advanced skill frontmatter. Use disable-model-invocation, context:fork, or argument-hint in skill frontmatter for better control.",
          "file": null,
          "line": null,
          "evidence": null,
          "category": "t3",
          "recommendation": "Use disable-model-invocation, context:fork, or argument-hint in skill frontmatter for better control.",
          "autoFixable": false
        },
        {
          "id": "CA-GAP-012",
          "scanner": "GAP",
          "severity": "info",
          "title": "No subagent isolation",
          "description": "Feature gap: No subagent isolation. Use isolation: worktree in agent frontmatter for safe parallel development.",
          "file": null,
          "line": null,
          "evidence": null,
          "category": "t3",
          "recommendation": "Use isolation: worktree in agent frontmatter for safe parallel development.",
          "autoFixable": false
        },
        {
          "id": "CA-GAP-013",
          "scanner": "GAP",
          "severity": "info",
          "title": "No dynamic skill context",
          "description": "Feature gap: No dynamic skill context. Use !`command` syntax in skills to inject dynamic context (e.g., !`git branch --show-current`).",
          "file": null,
          "line": null,
          "evidence": null,
          "category": "t3",
          "recommendation": "Use !`command` syntax in skills to inject dynamic context (e.g., !`git branch --show-current`).",
          "autoFixable": false
        },
        {
          "id": "CA-GAP-014",
          "scanner": "GAP",
          "severity": "info",
          "title": "No autoMode classifier",
          "description": "Feature gap: No autoMode classifier. Configure autoMode in user/local settings with environment context and allow/deny rules.",
          "file": null,
          "line": null,
          "evidence": null,
          "category": "t3",
          "recommendation": "Configure autoMode in user/local settings with environment context and allow/deny rules.",
          "autoFixable": false
        },
        {
          "id": "CA-GAP-015",
          "scanner": "GAP",
          "severity": "info",
          "title": "No custom plugin",
          "description": "Feature gap: No custom plugin. Package reusable skills, agents, and hooks as a Claude Code plugin with .claude-plugin/plugin.json.",
          "file": null,
          "line": null,
          "evidence": null,
          "category": "t4",
          "recommendation": "Package reusable skills, agents, and hooks as a Claude Code plugin with .claude-plugin/plugin.json.",
          "autoFixable": false
        },
        {
          "id": "CA-GAP-016",
          "scanner": "GAP",
          "severity": "info",
          "title": "No managed settings",
          "description": "Feature gap: No managed settings. Use managed-settings.json for organization-wide policy enforcement.",
          "file": null,
          "line": null,
          "evidence": null,
          "category": "t4",
          "recommendation": "Use managed-settings.json for organization-wide policy enforcement.",
          "autoFixable": false
        },
        {
          "id": "CA-GAP-017",
          "scanner": "GAP",
          "severity": "info",
          "title": "No LSP plugins",
          "description": "Feature gap: No LSP plugins. Add .lsp.json for real-time code intelligence from language servers.",
          "file": null,
          "line": null,
          "evidence": null,
          "category": "t4",
          "recommendation": "Add .lsp.json for real-time code intelligence from language servers.",
          "autoFixable": false
        }
      ],
      "counts": {
        "critical": 0,
        "high": 0,
        "medium": 1,
        "low": 5,
        "info": 11
      }
    },
    {
      "scanner": "TOK",
      "status": "ok",
      "files_scanned": 2,
      "duration_ms": 120,
      "findings": [
        {
          "id": "CA-TOK-001",
          "scanner": "TOK",
          "severity": "low",
          "title": "High MCP tool-schema budget on server \"memory\"",
          "description": "MCP server \"memory (.mcp.json)\" has tool count unknown — could not parse manifest or cached tools/list. Tool schemas load on every turn; an unverified server may be inflating the per-turn payload silently.",
          "file": ".mcp.json",
          "line": null,
          "evidence": "tool_count=unknown; server=\"memory\"; source=\".mcp.json\" — severity reflects estimated tokens/turn based on structural heuristic; not measured against runtime telemetry",
          "category": "token-efficiency",
          "recommendation": "Install the package locally (so detect-mcp-tool-count can read its manifest), or run the server once and cache its tools/list response under ~/.claude/config-audit/mcp-cache/<name>.json. See knowledge/cache-telemetry-recipe.md.",
          "autoFixable": false
        }
      ],
      "counts": {
        "critical": 0,
        "high": 0,
        "medium": 0,
        "low": 1,
        "info": 0
      },
      "hotspots": [
        {
          "source": "mcp:memory (.mcp.json)",
          "estimated_tokens": 500,
          "rank": 1,
          "recommendations": [
            "Review whether this source needs to load on every turn."
          ]
        },
        {
          "source": "mcp:sadhguru-wisdom (plugin:sadhguru-wisdom)",
          "estimated_tokens": 500,
          "rank": 2,
          "recommendations": [
            "Review whether this source needs to load on every turn."
          ]
        },
        {
          "source": "mcp:vegnorm-rag (plugin:vegnormalene)",
          "estimated_tokens": 500,
          "rank": 3,
          "recommendations": [
            "Review whether this source needs to load on every turn."
          ]
        },
        {
          "source": "CLAUDE.md",
          "estimated_tokens": 116,
          "rank": 4,
          "recommendations": [
            "Move volatile top-of-file content to the bottom or extract to an @import-ed file.",
            "Split overlong CLAUDE.md into focused @imports (≤200 lines each)."
          ],
          "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/CLAUDE.md"
        },
        {
          "source": "hooks/hooks.json",
          "estimated_tokens": 81,
          "rank": 5,
          "recommendations": [
            "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
            "Move rarely-used permissions to a project-local override."
          ],
          "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/hooks/hooks.json"
        },
        {
          "source": ".claude/settings.json",
          "estimated_tokens": 59,
          "rank": 6,
          "recommendations": [
            "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
            "Move rarely-used permissions to a project-local override."
          ],
          "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json"
        },
        {
          "source": ".mcp.json",
          "estimated_tokens": 53,
          "rank": 7,
          "recommendations": [
            "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
            "Move rarely-used permissions to a project-local override."
          ],
          "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.mcp.json"
        }
      ],
      "total_estimated_tokens": 1809,
      "activeConfig": {
        "claudeMdEstimatedTokens": 5716,
        "mcpServerCount": 3,
        "pluginCount": 41,
        "skillCount": 65
      }
    },
    {
      "scanner": "CPS",
      "status": "ok",
      "files_scanned": 1,
      "duration_ms": 0,
      "findings": [],
      "counts": {
        "critical": 0,
        "high": 0,
        "medium": 0,
        "low": 0,
        "info": 0
      }
    },
    {
      "scanner": "DIS",
      "status": "ok",
      "files_scanned": 1,
      "duration_ms": 0,
      "findings": [
        {
          "id": "CA-DIS-001",
          "scanner": "DIS",
          "severity": "low",
          "title": "Tool listed in both permissions.deny and permissions.allow",
          "description": ".claude/settings.json contains 1 tool present in both deny and allow lists. The deny list wins — the allow entries are dead config but still load on every turn and may confuse future readers about intent.",
          "file": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json",
          "line": null,
          "evidence": "Read: allow=\"Read(src/**)\" + deny=\"Read(./.env)\"",
          "category": "permissions-hygiene",
          "recommendation": "Remove the redundant allow entries. If you actually want this tool enabled, remove it from the deny list instead. Settings should express intent clearly.",
          "autoFixable": false
        }
      ],
      "counts": {
        "critical": 0,
        "high": 0,
        "medium": 0,
        "low": 1,
        "info": 0
      }
    },
    {
      "scanner": "COL",
      "status": "ok",
      "files_scanned": 65,
      "duration_ms": 91,
      "findings": [
        {
          "id": "CA-COL-001",
          "scanner": "COL",
          "severity": "low",
          "title": "Skill name \"okr-offentlig-sektor\" used by multiple plugins",
          "description": "2 plugins (okr, okr) expose a skill named \"okr-offentlig-sektor\". Even when invocation is namespaced via /plugin:skill, shared names create ambiguity in error messages, search results, and the plugin-skills enumeration.",
          "file": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/okr/skills/okr-offentlig-sektor/SKILL.md",
          "line": null,
          "evidence": "name=\"okr-offentlig-sektor\"; plugins=okr,okr",
          "category": "plugin-hygiene",
          "recommendation": "Coordinate naming across plugins, or rename one to clarify intent. The shared name forces every reader to disambiguate by source.",
          "autoFixable": false,
          "details": {
            "namespaces": [
              {
                "source": "plugin:okr",
                "name": "okr-offentlig-sektor",
                "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/okr/skills/okr-offentlig-sektor/SKILL.md"
              },
              {
                "source": "plugin:okr",
                "name": "okr-offentlig-sektor",
                "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-privat/plugins/okr/skills/okr-offentlig-sektor/SKILL.md"
              }
            ]
          }
        }
      ],
      "counts": {
        "critical": 0,
        "high": 0,
        "medium": 0,
        "low": 1,
        "info": 0
      }
    }
  ],
  "aggregate": {
    "total_findings": 20,
    "counts": {
      "critical": 0,
      "high": 0,
      "medium": 1,
      "low": 8,
      "info": 11
    },
    "risk_score": 12,
    "risk_band": "Medium",
    "verdict": "PASS",
    "scanners_ok": 11,
    "scanners_error": 0,
    "scanners_skipped": 1
  }
}