What do I need to use Tool Permission Review?

The full capability list; The task; The environment's sensitivity; The autonomy level.

Is Tool Permission Review free to use?

Yes — run it free in the browser playground (no API key needed for the sponsored trial, or bring any provider key), or install it into Claude Code, Cursor, ChatGPT and more via npx pm-claude-skills. MIT-licensed and open source.

Tool Permission Review

Q: How do I know the Tool Permission Review output is good?

The skill verifies itself against its own quality checks: Every capability is inventoried by blast radius, not just named; Least privilege was applied — grants trace to a task need or they're cut; Dangerous combinations are flagged and broken or gated; Every survivor is tiered allow/ask/deny and enforced in config.

🔵 Stable🕐 updated 2026-07-21 🔷 SkillSpec L3 pm-seatbelt

Review what an agent is actually allowed to do before you turn it loose — the tool-by-tool audit (each capability's blast radius), the least-privilege pass that removes what the task doesn't need, the dangerous-combination check, and the allow/ask/deny tiering. Use when asked review my agent's permissions, what can this agent actually do, lock down my agent's tools, or is this MCP/tool set safe to grant. Produces the permission inventory with blast radius, the least-privilege cuts, the dangerous-combo flags, and the allow/ask/deny assignments.

▶ Run it free — no key needed 📝 Grade your existing draft View SKILL.md ↗

What to give it

▸The full capability list — every tool, MCP server, and native power (file, shell, browser, computer use, network) the agent has or would get; the review needs the actual grant, not the intended use

▸The task — what the agent is *for*; least privilege is defined against the task, and "convenience" grants are exactly what this removes

▸The environment's sensitivity — a sandbox vs. a machine with production access, real credentials, and company data (blast radius is capability × environment)

▸The autonomy level — supervised or autonomous; autonomous agents need more denied and more gated, because no human catches the misuse live

✅ The bar it holds itself to

Every skill in this library self-verifies — these are this skill's own quality checks, straight from its definition.

✓Every capability is inventoried by blast radius, not just named

✓Least privilege was applied — grants trace to a task need or they're cut

✓Dangerous combinations are flagged and broken or gated

✓Every survivor is tiered allow/ask/deny and enforced in config

✓Autonomous setups shifted toward restriction with caps and a kill-switch

⚠️ What it refuses to do

Do not grant by convenience — every unneeded capability is pure blast radius

Do not review tools in isolation — the dangerous combinations are where the exploits live

Do not trust the agent to self-restrain — tiers are enforced by config, not by good intentions

Do not grant shell or computer-use casually — they subsume most other tools and deserve the hardest deny-by-default

Do not give an autonomous agent supervised-grade permissions — no human is checking, so the grants must

Install

npx pm-claude-skills add --agent claude   # or codex · cursor · gemini · hermes
# or one-line MCP (every skill, any client):
claude mcp add pm-skills -- npx -y pm-claude-skills-mcp

Related skills

🔌 Embed this skill

Drop this on your blog, docs, or site — it renders a "Run this skill" card:

<div data-pm-skill="tool-permission-review"></div>
<script src="https://mohitagw15856.github.io/pm-claude-skills/embed.js" async></script>

💬 Discussion

Tool Permission Review is one of 750 open-source professional AI agent skills — all SkillSpec L3. Try them all in the browser · ⭐ Star on GitHub · Browse the full catalog