approval-hygiene

Analyzes session permission re-approvals and recommends settings.json allow-list and deny-list changes.

1|Updated Apr 8, 2026
One-click install
npx skills add https://github.com/jp5labs/forge-workflow --skill approval-hygiene-jp5labs
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: approval-hygiene
Source: https://github.com/jp5labs/forge-workflow/tree/main/forge_workflow/templates/skills/approval-hygiene
Command: npx skills add https://github.com/jp5labs/forge-workflow --skill approval-hygiene-jp5labs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Repeated permission re-approval prompts during agent sessions create toil and interrupt workflow, but blindly approving everything is unsafe. This Skill audits the re-approval log, grades each command pattern for safety, and recommends concrete configuration changes so recurring safe commands stop prompting and dangerous ones get denied. ## Core Features & Use Cases - Pattern Analysis: Reads the JSONL approval log, groups entries by tool and normalized command pattern, and counts occurrences per session. - A-F Safety Grading: Grades each pattern from read-only safe (A) to destructive (F) with justification covering blast radius, network access, and privilege level. - Actionable Recommendations: Suggests allow-list promotions, deny rules, narrower patterns, and alternative toil-reduction strategies, then applies approved changes via /update-config. - Use Case: After a long supervised session with dozens of pip install and docker build prompts, run the skill to get a stacked-card report grading each pattern, then promote safe ones to project settings and deny risky ones. ## Quick Start Ask the assistant to run an approval hygiene audit of this session's permission re-approvals and recommend settings changes.

Frequently Asked Questions about approval-hygiene

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I reduce repeated permission prompts in Claude Code sessions?

Run an approval hygiene audit to analyze the re-approval log, grade each command pattern A-F for safety, and promote safe patterns to the settings.json allow list. Approved changes are applied via /update-config after operator confirmation.

How to audit which commands an AI agent requested approval for?

The PermissionRequest hook logs every re-approval as a JSONL line to /tmp/forge-approval-log.jsonl with tool, input, and session_id. The skill groups these by normalized command pattern and produces a stacked-card report with counts, intent, and safety grades.

Does approval logging work in autonomous mode?

No. The skill checks the CLAUDE_MODE environment variable and exits immediately if it is set to autonomous, since approval logging is not active in that mode. It only runs in supervised mode or when the variable is unset.

What command patterns are considered unsafe to auto-approve?

Patterns graded D through F are unsafe: broad wildcards and arbitrary network access (D), privilege escalation like sudo (E), and destructive operations like rm -rf or force pushes (F). These get deny-rule recommendations plus alternative toil-reduction strategies.

Can the skill change settings.json without confirmation?

No. The full report is presented to the operator first, and only explicitly approved changes are applied via /update-config. Unapproved changes are never written to settings.