This would be theoretically possible. If all your Route via HTTP(S) assertions in all your policies are utilizing the system defaults then you only need to get the value of those two cluster-wide properties I mentioned. If any Route via HTTP(S) assertion needs a custom value, I would define a new cluster-wide property (example: ${gateway.serviceA_connectionTimeout}). That way you only need to audit cluster-wide properties to know these values.
Now you could do the harder approach which would be to hit the /restman/1.0/services endpoint and parse that response to search the <l7:Resource type="policy"> part of a service configuration to pull out the values I mentioned. But I would probably stick with option 1.