Skill

RescopePrompt

Tighten a prompt-shaped document's tool scope to the narrowest set it actually uses. USE WHEN an adopted or authored skill declares allowed-tools: '*', omits the frontmatter field entirely, or grants tools the workflow never invokes.

npx claudepluginhub n4m3z/forge-core

Tool Access

This skill is limited to using the following tools:

ReadEditGrep

Preview

Narrow a skill's `allowed-tools` frontmatter to the tools the workflow actually invokes. Implicit `"*"` and undeclared scope are treated as bugs. Referenced by [ForgeAdopt](../ForgeAdopt/SKILL.md) as the `rescope` transform.

SKILL.md

Similar Skills

cache-components

139.4k

Guides Next.js Cache Components and Partial Prerendering (PPR): 'use cache' directives, cacheLife(), cacheTag(), revalidateTag() for caching, invalidation, static/dynamic optimization. Auto-activates on cacheComponents: true.

cache-components

pdf

131.6k

Processes PDFs: extracts text/tables/images, merges/splits/rotates pages, adds watermarks, creates/fills forms, encrypts/decrypts, OCRs scans. Activates on PDF mentions or output requests.

11 files

document-skills

Stats

Stars4

Forks2

Last CommitApr 16, 2026

Actions

View Source View Plugin View on GitHub View README

Help us improve

Share bugs, ideas, or general feedback.

RescopePrompt

Narrow a skill's allowed-tools frontmatter to the tools the workflow actually invokes. Implicit "*" and undeclared scope are treated as bugs. Referenced by ForgeAdopt as the rescope transform.

What to narrow

allowed-tools: "*" — treat as declaration of intent, not trust; enumerate explicitly

Missing allowed-tools — add the field with the narrowest set the skill needs

Overbroad grants (for example Bash when the skill only reads files) — strip

Comma-separated strings with trailing whitespace, duplicates, or inconsistent casing — normalize

Procedure

Read the skill body end-to-end.

Identify every tool the workflow invokes. Watch for indirect invocation (a Bash command calling a tool the skill uses).

Start from zero. Add only the tools the workflow actually uses.

Prefer read-only scope (Read, Grep, Glob) over write or exec when the workflow allows.

If the skill invokes shell commands, grant Bash but note the expected command family in a comment or the description.

Write the result as a comma-separated list in the frontmatter.

Evidence required per tool

Tool

Grant only if the skill…

Read

reads a file

Grep

searches file contents

Glob

enumerates file paths

Edit

modifies an existing file

Write

creates or overwrites a file

Bash

invokes shell commands

Skill

composes other skills as build steps

WebFetch

retrieves remote content over HTTP

Constraints

Never grant Bash on speculation — find the command the skill runs

* is never an acceptable final value; if the skill genuinely needs everything, the skill is doing too much

Do not grant tools to "future-proof" the skill — add them when the workflow adds them

Document unusual grants in the skill body when the reason isn't obvious from the workflow

RescopePrompt

Narrow a skill's allowed-tools frontmatter to the tools the workflow actually invokes. Implicit "*" and undeclared scope are treated as bugs. Referenced by ForgeAdopt as the rescope transform.

What to narrow

allowed-tools: "*" — treat as declaration of intent, not trust; enumerate explicitly
Missing allowed-tools — add the field with the narrowest set the skill needs
Overbroad grants (for example Bash when the skill only reads files) — strip
Comma-separated strings with trailing whitespace, duplicates, or inconsistent casing — normalize

Procedure

Read the skill body end-to-end.
Identify every tool the workflow invokes. Watch for indirect invocation (a Bash command calling a tool the skill uses).
Start from zero. Add only the tools the workflow actually uses.
Prefer read-only scope (Read, Grep, Glob) over write or exec when the workflow allows.
If the skill invokes shell commands, grant Bash but note the expected command family in a comment or the description.
Write the result as a comma-separated list in the frontmatter.

Evidence required per tool

Tool	Grant only if the skill…
Read	reads a file
Grep	searches file contents
Glob	enumerates file paths
Edit	modifies an existing file
Write	creates or overwrites a file
Bash	invokes shell commands
Skill	composes other skills as build steps
WebFetch	retrieves remote content over HTTP

Constraints

Never grant Bash on speculation — find the command the skill runs
* is never an acceptable final value; if the skill genuinely needs everything, the skill is doing too much
Do not grant tools to "future-proof" the skill — add them when the workflow adds them
Document unusual grants in the skill body when the reason isn't obvious from the workflow