Agent Skills › rohitg00/pro-workflow › permission-tuner

permission-tuner

GitHub

分析权限拒绝模式，生成优化的 alwaysAllow 和 alwaysDeny 规则以减少提示疲劳。适用于频繁中断、新项目配置或大量手动审批后。通过扫描会话数据识别安全/中等/高风险操作，生成建议规则并在应用前请求用户批准。

skills/permission-tuner/SKILL.md rohitg00/pro-workflow

Trigger Scenarios

权限提示频繁打断工作流程开始新项目时配置权限经历多次手动审批后

Install

npx skills add rohitg00/pro-workflow --skill permission-tuner -g -y

More Options

Use without installing

npx skills use rohitg00/pro-workflow@permission-tuner

指定 Agent (Claude Code)

npx skills add rohitg00/pro-workflow --skill permission-tuner -a claude-code -g -y

安装 repo 全部 skill

npx skills add rohitg00/pro-workflow --all -g -y

预览 repo 内 skill

npx skills add rohitg00/pro-workflow --list

SKILL.md

Frontmatter

{
    "name": "permission-tuner",
    "description": "Analyze permission denial patterns and generate optimized alwaysAllow and alwaysDeny rules. Use when permission prompts are slowing you down or after sessions with many denials.",
    "user-invocable": true
}

Permission Tuner

Reduce permission prompt fatigue by analyzing denial patterns and suggesting targeted rules.

Trigger

Use when:

Permission prompts interrupt flow repeatedly
Starting a new project and want to configure permissions
After a session with many manual approvals

Workflow

Scan recent session data for permission patterns
Identify frequently-approved tools and patterns
Generate safe alwaysAllow rules
Present rules for approval before applying

Analysis

Step 1: Gather Permission Data

Check current permission rules:

cat .claude/settings.json 2>/dev/null | grep -A 20 "permissions"
cat ~/.claude/settings.json 2>/dev/null | grep -A 20 "permissions"

Step 2: Identify Safe Patterns

Allow-list candidates (low risk):

Read — all file reads (read-only, no side effects)
Glob — file pattern matching (read-only)
Grep — content search (read-only)
Bash(git status) — read-only git commands
Bash(git diff*) — read-only git commands
Bash(git log*) — read-only git commands
Bash(npm test*) — test execution
Bash(npm run lint*) — linting
Bash(npm run typecheck*) — type checking

Ask candidates (medium risk — prompt user every time):

Edit — file modifications
Write — new file creation
Bash(git add*) — staging changes
Bash(git commit*) — creating commits
Bash(npm install*) — dependency changes

Deny-list candidates (high risk):

Bash(git push*) — affects remote
Bash(git reset --hard*) — destructive
Bash(rm -rf*) — destructive
Bash(curl*POST*) — external API calls
Any command with --force or --no-verify

Step 3: Generate Rules

{
  "permissions": {
    "allow": [
      "Read",
      "Glob",
      "Grep",
      "Bash(git status)",
      "Bash(git diff*)",
      "Bash(git log*)",
      "Bash(npm test*)",
      "Bash(npm run lint*)",
      "Bash(npm run typecheck*)"
    ],
    "deny": [
      "Bash(rm -rf *)",
      "Bash(git push --force*)",
      "Bash(git reset --hard*)"
    ]
  }
}

Output

PERMISSION TUNER REPORT

Current rules: [X] allow, [Y] deny, [Z] ask

Recommendations:
  Auto-approve (safe, read-only):
    + Read, Glob, Grep
    + Bash(git status), Bash(git diff*), Bash(git log*)

  Auto-approve (medium risk, frequently used):
    + Edit (approved X times this session)
    + Bash(npm test*) (approved X times)

  Keep asking:
    ~ Bash(git commit*) — verify commit messages
    ~ Write — verify new file creation

  Auto-deny (dangerous):
    - Bash(rm -rf *)
    - Bash(git push --force*)

Estimated prompts saved per session: ~[N]