Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add echoVic/blade-code --skill permissions-and-workspace-trustgit clone --depth 1 https://github.com/echoVic/blade-codeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/echovic/blade-code/permissions-and-workspace-trust)<a href="https://agentmods.dev/skills/echovic/blade-code/permissions-and-workspace-trust"><img src="https://agentmods.dev/badge/skills/echovic/blade-code/permissions-and-workspace-trust.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00147 | $0.02507 |
| Opus 5 | $0.00073 | $0.01254 |
| Sonnet 5 | $0.00029 | $0.00501 |
| Haiku 4.5 | $0.00015 | $0.00251 |
Grade A, and why
knowledge-permissions-and-workspace-trust scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
81% identical to knowledge-session-state-and-context — 106 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 85 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Module Structure
权限系统先把工具调用归一化成规则签名，再应用运行模式、Session 审批和路径安全覆盖；Workspace Trust 则在资源加载前决定仓库控制的配置、命令和指令是否可见，外部 Hook 还需要独立摘要信任。
Directory Layout
packages/cli/src/config/PermissionChecker.ts— allow/ask/deny 规则和工具签名匹配packages/cli/src/tools/execution/PermissionResolver.ts— 模式、审计 Agent、Session 记忆和敏感路径覆盖packages/cli/src/tools/execution/ToolApprovalController.ts— 串行审批、Hook 审批和 project/session scopepackages/cli/src/tools/execution/ToolExecutionGuards.ts— CLI 白黑名单与 worktree 边界packages/cli/src/tools/validation/SensitiveFileDetector.ts— 凭据、环境文件和敏感目录分类packages/cli/src/security/WorkspaceIdentity.ts— canonical project 与 linked worktree trust rootpackages/cli/src/security/WorkspaceTrustService.ts— 项目来源审阅、继承决策和安全存储packages/cli/src/hooks/HookTrustService.ts— 外部 Hook 配置摘要信任packages/cli/src/hooks/HttpHookSecurity.ts— Hook URL 协议和内网限制packages/cli/src/browser/BrowserSecurity.ts— Browser origin、凭据控件和公开 URL 脱敏
Decision Entry
PermissionChecker.check()— 规则级deny > allow > ask > default askPermissionResolver.resolveRulePermission()— 审计 Agent、permission mode、Session 记忆和敏感路径的组合入口resolvePermissionDecision()— 规则结果与 PreToolUse Hook 决策的收紧合并WorkspaceTrustService.getStatus()— 计算not_required | trusted | untrusted | errorHookTrustService.getStatus()— 依据外部 Hook canonical digest 判断trusted | modified
Branching Table
| 工具/规则条件 | default |
autoEdit |
plan |
yolo |
|---|---|---|---|---|
| 未匹配的 ReadOnly | 自动允许 | 自动允许 | 自动允许 | 自动允许 |
| 未匹配的 Write | 请求确认 | 自动允许 | 拒绝 | 自动允许 |
| 未匹配的 Execute | 请求确认 | 请求确认 | 拒绝 | 自动允许 |
| 显式 allow 的 Write/Execute | 允许 | 允许 | 仍拒绝 | 允许 |
| 显式 deny 的普通工具调用 | 拒绝 | 拒绝 | 拒绝 | 当前实现先被模式改写为允许 |
| verification/review Agent 的写入或变异命令 | 拒绝 | 拒绝 | 拒绝 | 在模式覆盖前拒绝 |
| 中高敏感文件路径 | allow 会降为 ask，其余高敏感请求拒绝 | allow 会降为 ask，其余高敏感请求拒绝 | 写操作先拒绝 | 模式 allow 仍会降为 ask |
Affected Scope
packages/cli/src/tools/execution/— 每次工具调用的规则、Hook、审批和 safety overridepackages/cli/src/agent/runtime/SessionRuntime.ts— Session 权限模式恢复与 workspace 规则装配packages/cli/src/config/ConfigManager.ts— 可信项目权限、环境和可执行配置的过滤packages/cli/src/plugins/— 未信任项目的插件发现和启用阻断packages/cli/src/skills/与packages/cli/src/slash-commands/custom/— 项目 Skill/命令的 trust gatepackages/cli/src/hooks/— Folder Trust 之外的外部 Hook 摘要信任和 HTTP 安全packages/cli/src/browser/— URL/origin 分类、凭据控件和远端副作用审批packages/cli/src/server/routes/permission.ts与packages/cli/src/server/routes/workspaceTrust.ts— Web 审批和信任操作
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 85 lines · 147 tokens per session scan A 9c74504ec304
knowledge-permissions-and-workspace-trust is a skill published in the GitHub repository echoVic/blade-code (178 stars, last pushed yesterday), licensed MIT. It adds 147 tokens to every session and 2,507 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. It is 81% identical to knowledge-session-state-and-context, differing in 106 lines, and is treated as a copy.
Other skills, from other repositories
clinical-reports
Write comprehensive clinical reports including case reports (CARE guidelines), diagnostic reports (radiology/pathology/lab), clinical trial reports (ICH-E3, SAE, CSR), and patient documentation (SOAP, H&P, discharge summaries). Full support with templates, regulatory compliance (HIPAA, FDA, ICH-GCP), and validation…
clinical-decision-support
Generate professional clinical decision support (CDS) documents for pharmaceutical and clinical research settings, including patient cohort analyses (biomarker-stratified with outcomes) and treatment recommendation reports (evidence-based guidelines with decision algorithms). Supports GRADE evidence grading…
gget
Fast CLI/Python queries to 20+ bioinformatics databases. Use for quick lookups: gene info, BLAST searches, AlphaFold structures, enrichment analysis. Best for interactive exploration, simple queries. For batch processing or advanced BLAST use biopython; for multi-database Python workflows use bioservices.
histolab
Lightweight WSI tile extraction and preprocessing. Use for basic slide processing tissue detection, tile extraction, stain normalization for H&E images. Best for simple pipelines, dataset preparation, quick tile-based analysis. For advanced spatial proteomics, multiplexed imaging, or deep learning pipelines use pathml.
immunology-assays
Computational analysis of immunology experimental data. ATAC-seq differential accessibility, immune cell tracking from microscopy, ELISA data processing with 4-parameter logistic fitting, immunohistochemistry quantification, antibody titer analysis, and cell cycle phase duration estimation. For flow cytometry use…
molecular-cloning
Molecular cloning simulation and design. PCR amplicon prediction, restriction enzyme digestion, Golden Gate and Gibson assembly simulation, primer design, CRISPR sgRNA design, and plasmid annotation. For protein-level sequence analysis use biopython or esm; for database lookups use gene-database or ensembl-database.