permission-manager
Manage opencode permissions: review always-allow lists, suggest safe read-only commands, configure permission patterns
What I do
- Review and summarize currently always-allowed commands
- Suggest safe read-only commands for auto-approval
- Add or remove commands from the allow list in opencode.json
- Configure skill-level permissions (allow/deny/ask) with wildcard patterns
- Audit permission configs for security and usability
When to Use
Use this when optimizing opencode's permission settings, reviewing allowed commands, or configuring skill access controls.
Workflow Steps
- Read current config: Load
~/.config/opencode/opencode.jsonor project-levelopencode.json - Summarize permissions: Identify currently allowed commands and skill permissions
- Suggest additions: Propose safe read-only commands for auto-allow (see recommended list below)
- Apply changes: Edit the config to add/remove permission entries
- Validate: Ensure JSON is valid after changes
Complements opencode's built-in allow/deny/ask permissions by auditing current config and recommending adjustments through conversation.
Key Rules
- Never allow commands that modify files, commit, push, or change system state
- Prefer exact command entries such as
git status --short,git diff --stat, andls -la - Avoid trailing wildcards such as
git status*unless the expanded command family has been manually reviewed as read-only - Confirm with user before modifying permission config
- Disting
Subscribers only
The full skill, its 2 bundled files and every download is included with every paid Complete AI plan.
Details
| Source | mskadu/opencode-agent-skills |
|---|---|
| License | MIT |
| Risk label | critical ("critical" means the skill may run commands or touch files — read before use) |
| Files | README.md, SKILL.md |
| Added | 2026-06-05 |
Related skills
accesslint-diff
Diff a live page's accessibility violations against a baseline — by default compares uncommitted changes (stash-based), or pass --branch [<name>] to diff against a branch. Reports only new violations introduced, violations fixed, and pre-existing count. Use `scan` for a full audit with no diffing.
accesslint-scan
Audit a live page for accessibility issues, locate each WCAG violation precisely, and return a selector-grounded fix worklist without editing.
accint-commitments
Triage acc's open promises and close them with honest real-world verdicts via acc_act(runtime="outcome").
accint-frames
Drain acc's deliberation queue — open/waiting brain_frames checkpointed by headless runs — via acc_act(runtime="continue").
accint-solve
Route a goal through acc's scored-memory loop via acc_act(runtime="solve"); deliberate any returned brain_frame and submit via continue.
ad-creative
Create, iterate, and scale paid ad creative for Google Ads, Meta, LinkedIn, TikTok, and similar platforms. Use when generating headlines, descriptions, primary text, or large sets of ad variations for testing and performance optimization.