{{REPO}}-grant-permissions

Grant the permissions a developer needs to work in this repo without a prompt on every routine command, while keeping sensitive files off-limits.

Permissions live in your agent's config file, not in memory or preferences — this skill edits that file. It does NOT loosen anything silently: propose the allow-list, show it, then write it.

{{PERMISSIONS_TARGET}}

Steps

1. Find the repo's real commands. Read CLAUDE.md and any rules files first. If there's no CLAUDE.md (common on third-party repos), fall back to README.md, CONTRIBUTING.md, package.json scripts, a Makefile/justfile/Taskfile.yml, and a scripts/ directory. Capture test, lint, format, type-check, build, and especially the run/dev/start command — that's the one people forget to allow.
2. Detect the stack and its runner from marker files:
   • pyproject.toml / setup.py → python, pytest, ruff, mypy/pyright, pip, uv
   • package.json → npm, npx, node, yarn, pnpm (read its scripts)
   • go.mod → go; Cargo.toml → cargo; Makefile → make
   • docker-compose.yml / Dockerfile → docker, docker compose
   • A scripts/ directory or a Makefile is the entrypoint in many repos (FastAPI runs bash scripts/test.sh; httpx runs scripts/test, scripts/check, scripts/lint). A Bash(pytest *) rule does NOT cover scripts/test — allow the runner itself (next step) or the tests still prompt.
3. Read the current permission file(s) so you merge instead of clobbering. Preserve every existing allow/deny entry and any hook config.
4. Build the allow-list (curated mode — the default):
   • The file tools: reading, editing, creating files, and searching. These are table stakes — an agent that has to ask before reading a file or writing a new one is unusable for local dev. In Claude Code that's the bare names Read, Edit, Write, Grep, Glob (no parens — a bare name allows the tool for any path, and the step-5 denies still win), which is the same baseline klaussy settings writes. On any other agent, translate to its vocabulary rather than copying those names: Gemini gates read_file/write_file/replace/glob/search_file_content, opencode has no per-tool names at all (its permission.read / permission.bash maps cover this instead). The permissions note at the top of this skill names the file and syntax yours actually uses — that wins over the Claude spelling here.
   • Bash(git *)
   • The hosting provider's CLI, from git remote get-url origin: a GitHub host means Bash(gh *), GitLab means Bash(glab *). Bitbucket has no first-party CLI, so there's nothing to add there. The review, address-review, restack, and PR skills all shell out to this one, and it's easy to miss because no marker file announces it.
   • Navigation/inspection builtins that otherwise block compound commands (see the compound-command note): Bash(cd *), Bash(ls *), Bash(pwd), Bash(echo *), Bash(mkdir *), Bash(which *), Bash(cat *), Bash(head *), Bash(tail *), Bash(wc *), Bash(find *), Bash(grep *), Bash(rg *), Bash(sort *), Bash(diff *)
   • Everyday file moves: Bash(cp *), Bash(mv *), Bash(touch *). rm is deliberately not here — deleting is the one routine command worth a prompt. Add it only on request.
   • one Bash(<tool> *) per stack command from step 2 (e.g. Bash(pytest *), Bash(npm *), Bash(cargo *))
   • the repo's runner if it uses one: Bash(bash scripts/*), Bash(sh scripts/*), Bash(./scripts/*), Bash(scripts/*), Bash(make *)
   • the run/dev command as its own entry (e.g. Bash(fastapi dev *), Bash(uvicorn *), Bash(npm run dev *), Bash(docker compose *))
5. Keep sensitive files denied. Add to deny if absent (see the Edit vs Write rule below): Read(**/.env) + Edit(**/.env), and the same pair for **/.env.*, **/.envrc, **/credentials.json, **/.aws/credentials, **/.npmrc, **/*.pem, **/*.key, **/id_rsa, **/id_ed25519. For agents with an ignore file (.cursorignore, .geminiignore), add the secret globs there too — those block Bash reads that per-tool deny rules miss (see safety note).
6. Merge and write. Union new entries into the existing arrays, drop exact duplicates, write valid JSON (or the agent's format). Report exactly what you added.
7. Tell the user how to widen or narrow it — that broad mode exists, and that removing an entry re-enables its prompt.