Setting the file. One moment.
Framework for evaluating tool permissions granted to agent skills.
| Tier 1 — Read-Only | Read, Grep, Glob | Low | Cannot modify anything; safe for analysis skills |
| Tier 2 — Execution | Bash | Medium | Can run arbitrary commands; should have clear justification |
| Tier 3 — Modification | Write, Edit, NotebookEdit | High | Can modify files; verify the skill needs to create/edit files |
| Tier 4 — Network | WebFetch, WebSearch | High | Can access external URLs; verify domains are necessary |
| Tier 5 — Delegation | Task | High | Can spawn subagents; increases attack surface |
| Tier 6 — Unrestricted | * (wildcard) | Critical | Full access to all tools; almost never justified |
For each tool in allowed-tools, verify:
- Is it referenced? Does the SKILL.md body mention operations requiring this tool?
- Is it necessary? Could the skill achieve its purpose without this tool?
- Is the scope minimal? Could a more restrictive tool achieve the same result?
Expected tool sets by skill type:
- Expected:
Read, Grep, Glob or Read, Grep, Glob, Bash
- Bash justification: Running linters, type checkers, or bundled scripts
- Examples: code-review, security-review, find-bugs
- Expected:
Read, Grep, Glob, Bash
- Bash justification: Git operations, CI commands, gh CLI
- Examples: commit, pr-writer, iterate-pr
- Expected:
Read, Grep, Glob, Write or Read, Grep, Glob, Bash, Write, Edit
- Write/Edit justification: Creating or modifying documentation, configs
- Examples: agents-md, doc-coauthoring
- Expected:
Read, Grep, Glob, Bash, WebFetch
- WebFetch justification: Fetching documentation, API specs
- Flag if: WebFetch is present but no URLs appear in skill instructions
- Expected: Almost never
- If seen: Requires strong justification — the skill should be doing something that genuinely needs broad access
- Flag:
* wildcard, or more than 5 distinct tools
Combinations and patterns that warrant scrutiny:
Rate the overall permission profile:
references/permission-analysis.md