claude-permissions-optimizer

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to present extracted session commands and examples verbatim (from transcripts) in its recommendations and tables, which can include API keys, bearer tokens, cookies, or passwords found in those commands, so it requires outputting secret values directly if they exist in history.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill instructs the agent to programmatically modify Claude Code permission allowlists (writing ~/.claude/settings.json and project .claude/settings.json) to auto-allow Bash commands, effectively bypassing the permission prompt security mechanism and weakening safety even though it doesn't require sudo or change system files.