draft-auto-mode-rules

A guided drafting tool for Claude Code’s autoMode classifier block, which is natural-language guidance for deciding what actions to approve automatically. It asks about allowed and disallowed work and prints a JSON block for you to paste.

In plain words
What is it for?
Use it to create an auto-approval policy, record its boundaries and reasons, and produce a paste-ready block without changing your settings.
Why use it?
Conditions buried in long prose can be missed by a language-model classifier. This organizes the rules into clearly labeled covered and not-covered cases.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/melodic-software/claude-code-plugins/draft-auto-mode-rules
Any agent
npx skills add melodic-software/claude-code-plugins --skill draft-auto-mode-rules
Clone the repo
git clone --depth 1 https://github.com/melodic-software/claude-code-plugins

Made for: Claude Code, Codex.

Per session 146 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,668 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00146 $0.01668
Opus 5 $0.00073 $0.00834
Sonnet 5 $0.00029 $0.00334
Haiku 4.5 $0.00015 $0.00167

Measured 2d ago against content hash 916621966658, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

draft-auto-mode-rules scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

The scan reads SKILL.md. This mod also ships 2 executable files (scripts/draft-automode-block.sh, scripts/draft-automode-block.test.sh), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/claude-config/skills/draft-auto-mode-rules/SKILL.md · 132 lines

How it starts

The opening of the file, as written. The whole thing — 132 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Purpose

The autoMode block is a natural-language prompt for a classifier, not a rule list the harness matches, so it fails in ways a config file does not. claude auto-mode critique, run against a real 66 KB hand-authored block, found the pattern: the classifier is "an LLM doing a single pass under a 'default is ALLOW' instruction", so "buried conditions in paragraph position 40 will be missed at a materially higher rate than conditions in a bullet list."

This skill applies that finding at authoring time instead of reporting it afterwards.

Report-only, permanently

This skill writes nothing, in any scope, under any flag. It prints a block; you paste it. Editing a consumer's settings file would be making a permission decision on their behalf, which is the one thing this plugin exists not to do.

Scope boundary (route out)

  • What is in effect now, what auto mode drops, what a section discards → claude-config:audit-permission-state. Run it first. Drafting against rules you have not read is how a block ends up contradicting itself.
  • Grant portability and auto-mode durability → claude-config:audit-permission-grants.
  • Whether an existing block is any good → claude auto-mode critique, surfaced by audit-permission-state --critique. It owns the semantic judgment; this skill owns composition.

Inputs, and one deliberate omission

The draft is built from the interview plus the effective merge (audit-permission-state), and nothing else.

An earlier design read "the repo's observed prompt and denial history". That was dropped: it named no actual location, and an unnamed read surface in a skill shipped to consumers is unreviewable. Do not reintroduce a history input without re-opening that decision.

Phase 1: Read what already exists

Before asking anything, run the audit sibling and read its output:

bash "${CLAUDE_PLUGIN_ROOT}/skills/audit-permission-state/scripts/automode-block-lint.sh"

Three things there change what you should ask:

Read the full file on GitHub · 132 lines

Files

What ships with it

3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 132 lines · 146 tokens per session scan A 916621966658

Subscribe to this mod's changes

draft-auto-mode-rules is a skill published in the GitHub repository melodic-software/claude-code-plugins (13 stars, last pushed today), licensed MIT. It adds 146 tokens to every session and 1,668 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

deep-research

Conducts iterative deep research on any topic using web search, progressive exploration, and structured synthesis. Use when asked for comprehensive research, deep investigation, thorough analysis, or multi-source exploration of any topic. Triggers: research, investigate, deep dive, comprehensive analysis, explore…

jimmc414/claude-code-plugin-marketplace · 64 tokens

error-ux

Principles and patterns for writing error messages that help users recover. Use when auditing, writing, or improving error messages in code. Triggers: error messages, user experience, error handling, exception messages, validation errors.

jimmc414/claude-code-plugin-marketplace · 48 tokens

adversarial-patterns

Library of realistic adversarial attack vectors and anti-patterns to avoid. Contains examples of valid attacks and subtle gaming patterns to reject.

jimmc414/claude-code-plugin-marketplace · 32 tokens

documentation-testing

Provides heuristics for identifying incomplete or broken documentation. Use when validating README setup instructions, testing onboarding flows, or auditing documentation quality. Triggers: docs, readme, onboarding, setup validation, documentation audit.

jimmc414/claude-code-plugin-marketplace · 45 tokens

adversarial-analysis

Analyze code to identify explicit contracts, implicit usage patterns, and realistic boundary conditions. Contains concrete formulas for calculating input realism limits. Use before generating adversarial tests.

jimmc414/claude-code-plugin-marketplace · 37 tokens

build-expression-tree

For symbolic computation: ASTs, mathematical expressions, code that manipulates code structure, expression transformations.

jimmc414/claude-code-plugin-marketplace · 24 tokens