CLI-Anything Bundle #10 — Config Recon Pack

CLI-Anything Bundle #10 — Config Recon Pack (4 New AI Agent Skills)

Four NEW agent-native CLI harnesses that answer, in mask-safe order, the questions every AI agent should settle about a machine’s configuration before touching it: what is in the environment (names only), which .env-family files exist and how sick are they, is this one config file parseable, and did the config tree drift since the last fingerprint.

Values are never printed. Recon reads; drift is data.

What’s inside

skill	one-liner
envpeek	masked environment recon: `--self` / target PID via /proc//environ — NAME=***:LEN CLASS rows; one operator-named `--show KEY` reveal
dotenvscan	.env-family file recon: var counts, duplicate keys, empty values, quoting mix, export prefixes, inline-comment risks, malformed lines, masked previews
cfglint	structural lint of ONE config file: json (dup-key aware, exact line:col errors), ini (configparser strict), toml (tomllib, honest unsupported before 3.11), env line-scans; placeholders + secret-CLASS key names
cfghash	config-tree fingerprints: sha256 row per file + keys-digest (key paths only), TREE_MANIFEST, `--compare` → OK/CHANGED/NEW/MISSING rows

Install — one step per skill

Copy each skill folder (e.g. envpeek/, containing its SKILL.md) into your agent’s skills directory, e.g. ~/.openclaw/skills/. Works with OpenClaw, Claude Code, Codex, or any Agent-Skills-convention runtime.

Every skill also runs as a plain CLI — Python 3.8+, standard library only, --json output everywhere:

python3 envpeek/agent-harness/cli_anything/envpeek/__main__.py --help

or, per skill, pip install from its agent-harness/ (console script cli-anything-envpeek / cli-anything-dotenvscan / cli-anything-cfglint / cli-anything-cfghash).

The pipeline that matters

envpeek (who am I running as) → dotenvscan (which env files exist and how dirty are they) → cfglint (does this one file even parse) → cfghash (did the tree drift since last time — as data rows, exit-code CI contract). Read-only recon stages; the only write any tool can do is cfghash’s explicit --save PATH.

Verify before you trust

Every skill ships its own self-test battery that live-fires the real CLI on the running host. Verified 2026-10-19: 17 + 14 + 16 + 16 = 63 checks, 0 failed.

python3 envpeek/agent-harness/cli_anything/envpeek/tests/test_core.py
python3 dotenvscan/agent-harness/cli_anything/dotenvscan/tests/test_core.py
python3 cfglint/agent-harness/cli_anything/cfglint/tests/test_core.py
python3 cfghash/agent-harness/cli_anything/cfghash/tests/test_core.py

Safety contract

Reads only: os.environ, /proc//environ (same-user), config files you point at, os.walk over the tree you name. No sockets, no signals, no subprocess tricks. Values are masked everywhere; the single exception is envpeek’s explicit one-key --show, announced on stderr. cfghash writes nothing unless you pass --save PATH.

Apache 2.0. Support: [email protected] — subject “BUNDLE10 CFG”.

Built on SoulTech AI by Kiwann Williams. All Is One. One Is All.