Borrowing it
Nothing to install: this file belongs to lksnext-ai-lab/spec-kit-template. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/lksnext-ai-lab/spec-kit-template/main/.github/skills/generate-tool-permissions/SKILL.mdgit clone --depth 1 https://github.com/lksnext-ai-lab/spec-kit-templateWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lksnext-ai-lab/spec-kit-template/generate-tool-permissions)<a href="https://agentmods.dev/skills/lksnext-ai-lab/spec-kit-template/generate-tool-permissions"><img src="https://agentmods.dev/badge/skills/lksnext-ai-lab/spec-kit-template/generate-tool-permissions/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/lksnext-ai-lab/spec-kit-template/generate-tool-permissions"><img src="https://agentmods.dev/badge/skills/lksnext-ai-lab/spec-kit-template/generate-tool-permissions.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01367 |
| Opus 5 | $0.00000 | $0.00683 |
| Sonnet 5 | $0.00000 | $0.00273 |
| Haiku 4.5 | $0.00000 | $0.00137 |
Grade A, and why
generate-tool-permissions scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 134 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill: generate-tool-permissions
Propósito
Generar TOOL_PERMISSIONS completo (148 entries) a partir de la tabla de docs/spec/60-backend.md (sección 3) y actualizar EP-001 sección 5 con el mapeo completo.
Este skill es project-specific (no forma parte del framework spec-kit). Mantiene documentación sincronizada con la definición actual del backend.
Cuándo usar
- Completar el TODO asociado a la generación de
TOOL_PERMISSIONSen evidencia (p.ej.TODO-I03-012) - Regenerar
TOOL_PERMISSIONStras cambios en la tabla de tools de60-backend.md - Validar consistencia entre la tabla de tools y el mapeo publicado en evidencias
Protocolo de ejecución
1) Leer tabla de tools (60-backend.md sección 3)
- Archivo:
docs/spec/60-backend.md - Sección:
## 3. Mapeo completo Endpoints HTTP → Tools MCP - Columnas esperadas:
| Tool Name | Endpoint HTTP | Permission | Sync/Async | Categoría | - Parsear todas las filas (ignorar header y separador)
2) Extraer entries
Por cada fila de tabla:
- Tool Name: columna 1 (snake_case, ej:
apps_list,public_chat_call) - Permission: columna 3 (formato
resource:operation, ej:apps:read,agents:execute) - Parsear permission: split por
:→(resource, operation)
Validaciones mínimas:
- Total entries esperado: 148 (si el backend cambia, este número puede cambiar; en ese caso, no inventar: actualizar el “esperado” solo si la tabla fuente lo justifica).
- Formato permission:
^[a-z_]+:(read|write|delete|execute)$ - No duplicados en
tool_name
3) Generar tabla Markdown
Formato output para EP-001 sección 5:
| Tool Name | Resource | Operation |
|-----------|----------|-----------|
| admin_activate_user | admin | write |
| admin_deactivate_user | admin | write |
| ... (entries ordenados alfabéticamente) |
| version_get | version | read |
**Total: 148 tools mapeados**
Orden: alfabético por tool_name.
4) Generar dict Python (opcional, para código middleware)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 134 lines · 0 tokens per session scan A 5f31593f1060
generate-tool-permissions is a skill published in the GitHub repository lksnext-ai-lab/spec-kit-template (5 stars, last pushed 6mo ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 1,367 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
workspace-manager
Registers, lists, removes, and assigns workspaces (project directories) for Anima work. Use when: binding project paths to Anima, managing aliases, or switching workspace roots.
frontmcp-setup
Use when starting, scaffolding, or organizing a FrontMCP project. Covers creating a new project (CLI scaffold or manual) for Node, Vercel, and other targets; standalone versus Nx-monorepo layout, naming conventions, generators, and dependency rules; composing multiple @App classes, ESM packages, and remote MCP servers…
learn-project
Bootstrap cortex with project knowledge — reads key files and observes what it learns into the project namespace.
init
Lightweight project initialization — optionally scoped to specific files / tables / datasources / domains. Infer the project goal and in-scope datasources, scan the in-scope file tree and database metadata (db/table/desc/sample), classify into business domains, then write an AGENTS.md inventory skeleton plus the cheap…
project-planner
Detailed implementation plans and spec-driven development.
servicenow-hr-ppm
ServiceNow HR Service Delivery and Project Portfolio Management surface — fetch an employee HR profile and insert PPM cost plans and project tasks via the servicenow-api MCP server. Use when the agent must read a worker's HR profile or seed project financials (cost plans) and project task breakdowns through the…