claude-permissions-optimizer

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the model to extract and present session commands and "examples" from session transcripts (and to output them verbatim in recommendation tables), which can include API keys, tokens, or passwords with no redaction—so it requires handling/outputting secrets directly.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). This skill instructs the agent to automatically modify user- and project-level permission allowlists (writing ~/.claude/settings.json and .claude/settings.json) to suppress permission prompts and thereby bypass security controls and expand allowed command execution — a high-risk change to the agent's runtime security posture even though it doesn't use sudo or edit system files.