npx claudepluginhub activememory/ctx --plugin ctxThis skill uses the workspace's default tool permissions.
Audit `.claude/settings.local.json` permissions for entries that
Extracts safe Bash commands from Claude Code session history and auto-updates settings.json allowlist to minimize permission prompts.
Analyzes Claude Code permission denials and generates alwaysAllow/alwaysDeny rules for safe read-only ops like git status/npm test while blocking destructive commands.
Configures Claude Code security settings with permission wildcards, shell operator protections, and project-level access controls. Use for securing tools like Bash and workflows.
Share bugs, ideas, or general feedback.
Audit .claude/settings.local.json permissions for entries that
bypass safety hooks, grant overly broad access, or create injection
vectors. This is a defense-in-depth measure: hooks block dangerous
commands at runtime, but pre-approved permissions skip the
confirmation step that makes hooks visible.
/ctx-sanitize-permissions
/ctx-sanitize-permissions (after that long session)
cat .claude/settings.local.json
Parse the permissions.allow array.
Flag any permission matching these categories:
These pre-approve commands that safety hooks are designed to intercept. The hook still runs, but the user never sees the confirmation dialog: so they cannot reject it.
| Pattern | Why Dangerous |
|---|---|
Bash(git push:*) | Bypasses push-blocking hook confirmation |
Bash(git push) | Same: exact match variant |
Bash(git push --force:*) | Force push with no confirmation |
| Pattern | Why Dangerous |
|---|---|
Bash(rm -rf:*) | Recursive delete with no confirmation |
Bash(git reset --hard:*) | Discards uncommitted work |
Bash(git checkout .:*) | Discards all unstaged changes |
Bash(git clean -f:*) | Deletes untracked files |
Bash(git branch -D:*) | Force-deletes branches |
Bash(sudo:*) | Escalated privileges |
These allow the agent to modify files that control its own behavior: a self-modification vector that could be exploited via prompt injection.
| Pattern | Why Dangerous |
|---|---|
Any Bash(...) that could write to .claude/settings.local.json | Agent modifies its own permissions |
Any Bash(...) that could write to CLAUDE.md | Agent modifies its own instructions |
Any Bash(...) that could write to .claude/hooks/*.sh | Agent modifies safety hooks |
Any Bash(...) that could write to .context/CONSTITUTION.md | Agent modifies its own hard rules |
These are harder to detect by pattern alone. Look for overly broad
permissions like Bash(echo:*), Bash(cat:*), Bash(tee:*),
Bash(cp:*) that could be composed into writes to sensitive paths.
Flag them as informational: they have legitimate uses but are
worth noting.
| Pattern | Why Dangerous |
|---|---|
Bash(*:*) or Bash(*) | Allows any command |
Bash(curl:*) | Arbitrary network requests |
Bash(wget:*) | Arbitrary downloads |
Bash(pip install:*) | Arbitrary package installation |
Bash(npm install:*) | Arbitrary package installation |
Note: ctx init now automatically removes exact duplicates and
fully-qualified skill forms that are subsumed by bare equivalents
(e.g., Skill(ctx:ctx-agent) when Skill(ctx-agent) exists).
If you see these, suggest running ctx init to clean them up.
Look for remaining redundancies that automatic dedup does not cover:
Bash(git:*) makes Bash(git status:*) redundant)Sort both permissions.allow and permissions.deny arrays in
settings.local.json for easier visual scanning:
Bash(...), Edit(...), Read(...),
Skill(...), WebFetch(...), WebSearch, etc.This produces a stable, predictable order that makes it easy to spot duplicates, find specific entries, and review diffs.
Apply the sort directly to the file: this is a non-destructive reformat. Show the user a summary of what moved (e.g., "Sorted 45 allow entries and 8 deny entries into 4 tool groups").
Format findings by severity:
## Permission Audit Results
### Critical (hook bypass)
- `Bash(git push:*)`: bypasses block-git-push.sh
### High (destructive / injection vector)
- `Bash(rm -rf:*)`: recursive delete, no confirmation
### Medium (overly broad)
- `Bash(curl:*)`: arbitrary network access
### Informational
- `Bash(cat:*)`: could compose into config file writes
- 3 duplicate entries found
### Clean
- 45 permissions reviewed, no issues found
For each finding, offer a specific action:
When removing permissions, edit .claude/settings.local.json
directly. Show the diff before and after.
Bash(go test:*)): use judgmentAfter running the audit, verify: