Claude Skill MartBrowse skillsQuick linesLearn by videoTerminal guideWhat is a Skill?
 
← Back to list

Claude Permissions Audit (audit-permissions)

A maintenance skill that scans project-local Claude Code permissions, promotes the good ones to global config, and cleans up redundant or risky entries.

UtilitiesIntermediate★ 462⑂ 38AI score 9/10Last updated: Sep 27, 2026

What it does

  • Discovers every .claude/settings.local.json under your home directory (via fd, depth-capped at 5, excluding node_modules, Library, .git) and aggregates permission patterns with occurrence counts.
  • Phase 1 presents promotion candidates — safe, repeated patterns like git diff *, cargo test *, gh pr view * — as tables, asks for your decision, then writes them into ~/.claude/settings.json (resolving symlinks with readlink -f so dotfile setups aren't clobbered).
  • Phase 2 runs a dry-run cleanup script to list local permissions already covered by global config, then bulk-removes them and normalizes legacy colon syntax Bash(cmd:*) to Bash(cmd *).
  • Phase 3 surfaces the judgment calls: high-risk grants (curl *, rm *, eval *), conflicts with policies stated in your global CLAUDE.md, one-off cruft with hardcoded paths, cross-project file access, side-effecting MCP tools and server wildcards, plus deletion of now-empty settings files.
  • Wraps up by recording risk tolerance, tool preferences, exceptions, and a session history entry in ~/.claude/cc-maintenance.local.md for future audits.

Who it's for

  • Heavy Claude Code users whose settings.local.json files have sprawled across dozens of repos.
  • Anyone tired of re-approving the same commands who wants a tidy global allow list.
  • Security-minded users who want periodic review of dangerous permissions they granted in a hurry.
  • People managing Claude config through dotfiles/symlinks (macOS, Nix).

Example uses

  1. "Audit claude permissions" → aggregates 340 permissions across 12 projects and proposes 13 safe patterns seen in 5+ projects for global promotion.
  2. "Clean up claude settings" → shows a per-file table of 220 locally redundant permissions, then applies removal with --apply and normalizes syntax.
  3. "Review local claude settings" → recommends dropping Bash(curl *), flags WebFetch as conflicting with a "prefer Firecrawl" policy in CLAUDE.md, and offers to delete 3 now-empty settings files.

· · · Install guide · · ·

Try it now, no install

Paste this into Claude to use the skill without installing anything.

Read the instructions in this file and follow them to help me:
https://raw.githubusercontent.com/malob/nix-config/HEAD/configs/claude/plugins/cc-maintenance/skills/audit-permissions/SKILL.md

What I want: (describe your task here)

If Claude can't open the link, open it yourself and paste the contents instead.

↓ If it works for you, download the ZIP below and install it. Then it runs on its own — no pasting each time.

Install in the Claude app (no terminal)
  1. Download the ZIP with the button below.
  2. In Claude, open Settings → Capabilities and turn on 'Code execution and file creation'. (one time)
  3. Go to Customize → Skills → + → 'Upload a skill' and upload the ZIP.
↓ Download ZIP
Install in Claude Code

Let Claude do it — paste this into Claude Code

Install the skill I found on Claude Skill Mart.
Copy the configs/claude/plugins/cc-maintenance/skills/audit-permissions folder from the GitHub repo malob/nix-config into my ~/.claude/skills/audit-permissions/.
When it's done, tell me in one line what this skill can do.

Install with a command instead

git clone --depth 1 https://github.com/malob/nix-config /tmp/nix-config && mkdir -p ~/.claude/skills && cp -r /tmp/nix-config/configs/claude/plugins/cc-maintenance/skills/audit-permissions ~/.claude/skills/

⚠ This is a third-party skill. Check the source repository before installing.

  1. Open a terminal.
  2. Make sure you have git, python3, and fd installed (macOS: brew install fd).
  3. Shallow-clone the repo: git clone --depth 1 https://github.com/malob/nix-config /tmp/nix-config
  4. Copy the skill: mkdir -p ~/.claude/skills && cp -r /tmp/nix-config/configs/claude/plugins/cc-maintenance/skills/audit-permissions ~/.claude/skills/
  5. Make the scripts executable: chmod +x ~/.claude/skills/audit-permissions/scripts/*
  6. Back up your global config first: cp ~/.claude/settings.json ~/.claude/settings.json.bak
  7. Restart Claude Code and say "audit claude permissions".
  8. On the first run, read each phase's dry-run table carefully and apply only the changes you're sure about.
View source on GitHub ↗License: MIT