analyze-permissions git:20260724.d5bebf2A

Immutable. This exact content never changes and is served at /api/v1/blob/7c99cb95d5be5326.

---
name: analyze-permissions
description: Analyze accumulated permissions and suggest smart wildcard patterns. Only invoke when the user explicitly runs /analyze-permissions or asks to analyze their Claude Code permissions.
argument-hint: [analyze|apply|cleanup]
model: sonnet
---

# Analyze Claude Code Permissions

Analyze accumulated permissions in `settings.local.json` and suggest smart wildcard patterns to add to the shared configuration.

## Arguments (parsed from user input)

- **action**: What to do - `analyze` (default), `apply`, or `cleanup`

Example invocations:

- `/analyze-permissions` → analyze and suggest patterns
- `/analyze-permissions apply` → apply suggested patterns to shared config
- `/analyze-permissions cleanup` → just run the cleanup script

## Your Task

### Step 1: Read Current Permissions

Read these files:

1. **Project-local**: `<project-root>/.claude/settings.local.json` - accumulated "Always allow" permissions (per-project, not at `~/.claude/`)
2. **Global**: `~/.claude/settings.json` - shared/base permissions managed by the configure script
3. **Configure script**: `~/.dotfiles/ai/configure-tool-permissions.sh` - canonical source for global permissions

Note: `settings.local.json` is project-specific. Each repo has its own at `<repo>/.claude/settings.local.json`. The global `~/.claude/settings.json` is shared across all projects.

### Step 2: Analyze Patterns

For each entry in `settings.local.json`:

1. **Check if already covered** - Is there a wildcard in `settings.json` that covers this?
   - `Bash(git commit -m "Fix bug")` is covered by `Bash(git commit:*)`
   - `Bash(curl https://api.example.com)` is covered by `Bash(curl:*)`

2. **Identify pattern opportunities** - Group similar commands:
   - Multiple `kubectl` commands → suggest `Bash(kubectl:*)`
   - Multiple `docker` commands → suggest `Bash(docker:*)`
   - Multiple WebFetch for same domain → suggest `WebFetch(https://example.com/*)`

3. **Decide global vs local** - Where should the pattern live?
   - **Global (configure script)**: General-purpose tools used across projects (`npx`, `python`, `docker compose`, etc.)
   - **Local (settings.local.json)**: Project-specific commands, or write operations you only want for that project (e.g., `git push` for a personal repo)

4. **Assess safety** - Consider if the pattern is safe for auto-approval:
   - Read-only commands: Generally safe
   - Commands with side effects: Flag for review; consider keeping them per-project in local settings (e.g. `git push` for a personal repo)
   - Overly broad patterns: Warn about security implications
   - Never suggest auto-approving `sudo`, permission-loosening patterns like `chmod 777`, or anything that could expose credentials or secrets

### Step 3: Present Analysis

Output a structured report:

```markdown
## Permission Analysis

### Settings Overview
- settings.local.json: X entries
- settings.json: Y entries (Z wildcards)

### Already Covered (can be removed)
These entries in settings.local.json are redundant:

| Entry | Covered by |
|-------|------------|
| Bash(git commit -m "...") | Bash(git commit:*) |

### Suggested New Patterns
These patterns would consolidate multiple specific entries:

| Pattern | Covers | Safety |
|---------|--------|--------|
| Bash(kubectl:*) | 4 entries | ✅ Safe (read-heavy) |
| Bash(docker exec:*) | 3 entries | ⚠️ Review (can modify) |

### Uncategorized
These entries don't fit a pattern (one-offs):

- Bash(some-specific-command)
```

### Step 4: Handle Actions

Based on the action argument:

**analyze (default):**

- Present the report
- Ask if user wants to apply suggestions

**apply:**

- For each suggested pattern, ask for confirmation
- Add approved patterns to `configure-tool-permissions.sh` in the PERMISSIONS_CONFIG section
- Run the cleanup script to remove now-redundant entries

**cleanup:**

- Just run `~/.claude/skills/analyze-permissions/scripts/cleanup-settings-local.sh`

### Step 5: Update Shared Config (if applying)

When adding patterns to `configure-tool-permissions.sh`:

1. Add new entries to the `PERMISSIONS_CONFIG` JSON array
2. Add at least one new entry to the validation `if` statement so the script knows to re-run
3. Run the script to apply changes: `~/.dotfiles/ai/configure-tool-permissions.sh`
4. Run cleanup to remove now-redundant entries from the current project's local settings: `~/.dotfiles/ai/skills/analyze-permissions/scripts/cleanup-settings-local.sh`

**Important**: The configure script *merges* new entries into `settings.json` but never removes existing ones. This means `settings.json` also accumulates "don't ask again" entries over time. The cleanup script only cleans `settings.local.json`. To fully clean `settings.json`, you'd need to manually remove redundant entries or rebuild it from the script.