From pro-workflow
Analyzes Claude Code permission denials and generates alwaysAllow/alwaysDeny rules for safe read-only ops like git status/npm test while blocking destructive commands.
npx claudepluginhub rohitg00/pro-workflow --plugin pro-workflowThis skill uses the workspace's default tool permissions.
Reduce permission prompt fatigue by analyzing denial patterns and suggesting targeted rules.
Extracts safe Bash commands from Claude Code session history and auto-updates settings.json allowlist to minimize permission prompts.
Configure allow/deny/ask permission rules in .claude/settings.json for Claude Code tools like Bash(git:*), Write, Edit. Builds layered policies with glob patterns for git commands.
Generates PermissionRequest hooks that auto-approve safe operations, auto-deny dangerous ones, and tailor rules to detected project stack. Safer alternative to --dangerouslySkipPermissions for manual permission mode.
Share bugs, ideas, or general feedback.
Reduce permission prompt fatigue by analyzing denial patterns and suggesting targeted rules.
Use when:
alwaysAllow rulesCheck current permission rules:
cat .claude/settings.json 2>/dev/null | grep -A 20 "permissions"
cat ~/.claude/settings.json 2>/dev/null | grep -A 20 "permissions"
Auto-approve candidates (low risk):
Read — all file reads (read-only, no side effects)Glob — file pattern matching (read-only)Grep — content search (read-only)Bash(git status) — read-only git commandsBash(git diff*) — read-only git commandsBash(git log*) — read-only git commandsBash(npm test*) — test executionBash(npm run lint*) — lintingBash(npm run typecheck*) — type checkingAsk candidates (medium risk — auto-approve only if user confirms):
Edit — file modificationsWrite — new file creationBash(git add*) — staging changesBash(git commit*) — creating commitsBash(npm install*) — dependency changesNever auto-approve (high risk):
Bash(git push*) — affects remoteBash(git reset --hard*) — destructiveBash(rm -rf*) — destructiveBash(curl*POST*) — external API calls--force or --no-verify{
"permissions": {
"allow": [
"Read",
"Glob",
"Grep",
"Bash(git status)",
"Bash(git diff*)",
"Bash(git log*)",
"Bash(npm test*)",
"Bash(npm run lint*)",
"Bash(npm run typecheck*)"
],
"deny": [
"Bash(rm -rf *)",
"Bash(git push --force*)",
"Bash(git reset --hard*)"
]
}
}
PERMISSION TUNER REPORT
Current rules: [X] allow, [Y] deny, [Z] ask
Recommendations:
Auto-approve (safe, read-only):
+ Read, Glob, Grep
+ Bash(git status), Bash(git diff*), Bash(git log*)
Auto-approve (medium risk, frequently used):
+ Edit (approved X times this session)
+ Bash(npm test*) (approved X times)
Keep asking:
~ Bash(git commit*) — verify commit messages
~ Write — verify new file creation
Auto-deny (dangerous):
- Bash(rm -rf *)
- Bash(git push --force*)
Estimated prompts saved per session: ~[N]