Permission Doctor Skill

Read-only permission analysis for host-platform settings. Detects redundant permissions, security anti-patterns, and validates permission syntax without making changes.

Enforcement

Execution mode: Run scripts exactly as documented; present analysis results without modifying files.

Prohibited actions:

• Do not modify any settings files; this skill is strictly read-only
• Do not invent script arguments not listed in the operations table
• Do not skip anti-pattern detection when analyzing settings

Constraints:

• Platform-neutral audits go through python3 .plan/execute-script.py plan-marshall:platform-runtime:platform_runtime permission analyze --checks {checks} --scope {scope} — the runtime resolves the active platform's settings path and load. This is the preferred entry point.
• The individual permission_doctor detection scripts run through python3 .plan/execute-script.py plan-marshall:tools-permission-doctor:permission_doctor {command} {args}, addressed by --scope (never a literal settings path).
• Use tools-permission-fix for any write operations.
• User-approved permissions must be excluded from suspicious reports.
• Do not hardcode a platform settings-file path (no ~/.claude/settings.json). Address the host platform by --scope; the runtime layer resolves the settings location for the active platform.