Skip to main content
hc
Submit
skillsSource-backedReview first Safety ✓ Privacy ✓

Claude Code Auto Mode Policy Review Capability Pack Skill

Expert capability pack for reviewing Claude Code autoMode settings blocks, trusted infrastructure prose, classifier rule overrides, and documented claude auto-mode CLI inspection before enabling permission-free auto mode.

by kiannidev·added 2026-06-16·
Claude CodeCodexWindsurfGeminiCursorCLI
HarnessClaude CodeCodexWindsurfGeminiCursorCLI
Level:expertType:capability-packVerified:validated
Review first — review before installing

Open the source and read safety notes before installing.

Safety notes

  • Omitting $defaults from autoMode arrays replaces entire built-in rule lists per docs.
  • Developer-added allow entries can override organization soft_deny rules—use managed permissions.deny for non-negotiable blocks.
  • Auto mode runs without routine permission prompts; permissions.deny still blocks before the classifier.

Privacy notes

  • autoMode.environment prose may describe internal hostnames and bucket names—redact external copies.
  • Recently denied actions in /permissions may expose attempted commands—handle logs internally.
  • Managed settings distribution exposes organization infrastructure descriptions to enrolled clients.

Prerequisites

  • Permission to edit user, local, or managed settings with autoMode blocks.
  • Inventory of trusted source control orgs, buckets, and internal domains.
  • Security stakeholder for managed permissions.deny hard blocks.

Schema details

Install type
package
Reading time
9 min
Difficulty score
79
Troubleshooting
Yes
Breaking changes
No
Source repository stats
Scope
Source repo
Package metadata
Skill and platform metadata
Skill type
capability-pack
Skill level
expert
Verification
validated
Verified at
2026-06-16
Retrieval sources
https://code.claude.com/docs/en/auto-mode-confighttps://code.claude.com/docs/en/permissionshttps://code.claude.com/docs/en/settingshttps://code.claude.com/docs/en/skillshttps://github.com/anthropics/claude-codehttps://developers.google.com/search/docs/fundamentals/creating-helpful-content
Tested platforms
Claude CodeClaudeCursorGeneric AGENTS
PlatformSupportInstall path
claude-codeNative.claude/skills/<skill-name>/SKILL.md
codexNative.agents/skills/<skill-name>/SKILL.md
windsurfNative.windsurf/skills/<skill-name>/SKILL.md
geminiNative.gemini/skills/<skill-name>/SKILL.md or .agents/skills/<skill-name>/SKILL.md
cursorAdapter.cursor/rules/<skill-name>.mdc
cliManualAGENTS.md or tool-specific context file
Full copyable content
# Trigger
"Apply the Claude Code auto mode policy review capability pack for this project."

# Required output
1) autoMode scope and settings file map
2) Trusted infrastructure environment prose review
3) allow, soft_deny, and hard_deny override checklist
4) claude auto-mode config verification plan
5) Privacy-safe policy summary

About this resource

Knowledge Freshness

Grounded in Claude Code auto-mode-config, permissions, and settings documentation verified on 2026-06-16. Classifier defaults evolve—run claude auto-mode defaults after upgrades before assuming built-in rules unchanged.

Retrieval Sources

Source Verification Notes

Verified against official auto-mode-config documentation on 2026-06-16:

  • autoMode settings configure the auto mode classifier for trusted infrastructure and rule overrides.
  • Classifier reads autoMode from user settings, .claude/settings.local.json, managed settings, and Agent SDK inline JSON—not shared .claude/settings.json.
  • autoMode.environment entries are prose descriptions of trusted repos, buckets, and domains; include "$defaults" to extend built-in lists.
  • allow, soft_deny, and hard_deny arrays also accept "$defaults"; omitting it replaces entire built-in lists for that section.
  • permissions.deny in managed settings blocks actions before the classifier and cannot be overridden.
  • Inspect effective rules with claude auto-mode config, built-ins with claude auto-mode defaults, and custom rule quality with claude auto-mode critique.
  • Repeated denials usually mean missing environment context for a destination.

Scope Note

Community policy review skill—not an Anthropic product. Applies documented autoMode settings and CLI inspection commands from auto-mode-config docs.

Core Workflow

  1. Confirm auto mode requirements and plan eligibility per permission modes docs.
  2. Map which settings scope applies: user, local project, managed, or SDK inline JSON.
  3. Draft autoMode.environment prose for source control, buckets, and internal domains.
  4. Decide whether to extend or replace allow, soft_deny, and hard_deny lists with "$defaults".
  5. Add permissions.deny managed hard blocks for actions that must never run.
  6. Run claude auto-mode config and compare output to intended policy.
  7. Optionally run claude auto-mode critique on custom prose rules.
  8. Review Recently denied entries in /permissions and add missing environment context.
  9. Publish privacy-safe policy summary for administrators.

Capability Scope

  • autoMode scope and settings file mapping.
  • Trusted infrastructure prose authoring review.
  • Rule override and $defaults inheritance checks.
  • CLI verification with auto-mode subcommands.
  • Denial triage and environment gap analysis.

Compatibility

Native

  • Claude Code: interactive and managed deployments using auto mode.

Manual Adaptation

  • Agent SDK: apply the same autoMode JSON in inline settings overrides per docs.

Required Inputs

  • Organization source control hosts and repo namespaces.
  • Trusted cloud bucket prefixes and internal API domains.
  • Existing managed permissions.deny patterns.
  • List of routine false-positive destinations from pilot users.

Production Rules

  • Prefer "$defaults" unless intentionally replacing entire built-in rule lists.
  • Use managed permissions.deny for non-negotiable security boundaries.
  • Write environment entries as prose a new engineer would understand—not regex patterns.
  • Re-run claude auto-mode config after every settings change.
  • Redact internal hostnames from external policy summaries when required.

Review Matrix

Check Pass criteria Doc basis
Scope correct autoMode in allowed settings files only Where classifier reads config
Environment prose Source control and buckets listed Define trusted infrastructure
Defaults preserved $defaults present when extending lists Override block and allow rules
Hard blocks permissions.deny for must-never actions permissions.deny precedence
Effective config claude auto-mode config matches intent Inspect defaults and effective config

Output Contract

  1. Settings scope map.
  2. Environment prose review notes.
  3. Rule override checklist.
  4. CLI verification plan and findings.
  5. Privacy-safe administrator summary.

Troubleshooting

Issue: Routine internal push still denied Fix: Add the destination to autoMode.environment, then re-run claude auto-mode config.

Issue: Custom soft_deny too permissive Fix: Confirm "$defaults" was not omitted accidentally—omission replaces all built-in soft blocks per docs.

Duplicate Check

Distinct from claude-code-sandboxed-bash-policy-capability-pack (sandbox boundaries) and generic permissions guides. This pack focuses on autoMode classifier configuration and claude auto-mode CLI verification.

Editorial Disclosure

Independent entry by kiannidev based on public Claude Code auto-mode-config docs. No paid placement or affiliate links.

#claude-code#auto-mode#policy#permissions#capability-pack

Source citations

Add this badge to your README

Show that Claude Code Auto Mode Policy Review Capability Pack Skill is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.

Listed on HeyClaude
[![Listed on HeyClaude](https://heyclau.de/badge/skills/claude-code-auto-mode-policy-review-capability-pack.svg)](https://heyclau.de/entry/skills/claude-code-auto-mode-policy-review-capability-pack)

How it compares

Claude Code Auto Mode Policy Review Capability Pack Skill side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.

FieldClaude Code Auto Mode Policy Review Capability Pack Skill

Expert capability pack for reviewing Claude Code autoMode settings blocks, trusted infrastructure prose, classifier rule overrides, and documented claude auto-mode CLI inspection before enabling permission-free auto mode.

Open dossier 		Claude Code Sandboxed Bash Policy Capability Pack Skill

Expert Claude Code sandboxed bash policy capability pack applying documented /sandbox enablement, filesystem and network boundaries, autoAllowBashIfSandboxed review, and fail-closed settings for autonomous shell workflows.

Open dossier 		Claude Code Deep Links Runbook Capability Pack Skill

Expert Claude Code deep links runbook capability pack for building safe claude-cli:// URLs, embedding them in incident runbooks, and validating cwd, repo, and prompt parameters before users press Enter.

Open dossier 		Claude Code Terminal Ergonomics Capability Pack Skill

Expert Claude Code terminal ergonomics capability pack for auditing multiline input, Option/Meta shortcuts, tmux passthrough, notifications, fullscreen rendering, themes, status lines, Vim mode, and custom keybindings before a user blames Claude for terminal behavior.

Open dossier
Trust
Install riskReview firstReview firstReview firstReview first
Notes Safety ✓ Privacy ✓ Safety ✓ Privacy ✓ Safety ✓ Privacy ✓ Safety ✓ Privacy ✓
Categoryskillsskillsskillsskills
Sourcesource-backedsource-backedsource-backedsource-backed
AuthorkiannidevkiannidevkiannidevYB0y
Added2026-06-162026-06-162026-06-132026-06-10
Platforms
Claude CodeCodexWindsurfGeminiCursorCLI
Claude CodeCodexWindsurfGeminiCursorCLI
Claude CodeCodexWindsurfGeminiCursorCLI
Claude CodeCodexWindsurfGeminiCursorCLI
Source repo————
Safety notes✓Omitting $defaults from autoMode arrays replaces entire built-in rule lists per docs. Developer-added allow entries can override organization soft_deny rules—use managed permissions.deny for non-negotiable blocks. Auto mode runs without routine permission prompts; permissions.deny still blocks before the classifier.✓Sandboxing reduces blast radius but does not replace human review of diffs. autoAllowBashIfSandboxed auto-approves some sandboxed commands—pair with deny rules. Missing dependencies can disable sandbox silently unless fail-closed settings apply. Network allowlists still permit egress to listed domains—document allowed hosts.✓Deep links pre-fill prompts but never auto-send; users must press Enter after reviewing the external-link warning. Untrusted pages can craft malicious prompts; treat every deep link like untrusted input until a human reviews it. Prompts over 1,000 characters show an extended warning; require scroll review before sending long links. Network and UNC paths are rejected for cwd; use absolute local paths or repo slugs instead. If both cwd and repo are passed, cwd wins even when the path does not exist; validate parameters deliberately. Organizations can disable handler registration with disableDeepLinkRegistration in settings or managed policy.✓This skill recommends terminal and Claude Code configuration changes; it must not edit dotfiles, keybindings, hooks, themes, or tmux settings without showing the proposed diff first. `/terminal-setup` writes terminal or editor keybindings and may adjust integrated-terminal settings; run it in the host terminal and record what changed before relying on it. tmux passthrough allows escape sequences to reach the outer terminal; enable it deliberately, especially on shared, remote, or security-sensitive hosts. Notification hooks can execute local commands when Claude needs attention; keep them simple, review command paths, and avoid hooks that send prompts or logs to third-party services. Fullscreen rendering, theme files, status lines, and keybinding changes should be treated as reversible local UI preferences, not fixes for model quality or project bugs.
Privacy notes✓autoMode.environment prose may describe internal hostnames and bucket names—redact external copies. Recently denied actions in /permissions may expose attempted commands—handle logs internally. Managed settings distribution exposes organization infrastructure descriptions to enrolled clients.✓Sandbox logs and permission prompts may capture command text and paths. Allowed write paths may include files with secrets—keep credentials out of sandbox scope. Policy summaries for external auditors should omit internal hostnames when possible.✓Deep link URLs embed prompt text in query parameters, which may expose incident details, customer names, or internal service names in browser history, chat logs, or ticketing systems. repo resolution uses the most recently used local clone path, which can reveal directory layout on shared screens via the welcome header. Runbooks pasted into GitHub-rendered Markdown lose clickable claude-cli:// links; code-block copies still expose full URLs to readers. Public runbooks should use redacted example prompts and generic repo slugs unless the audience is internal-only.✓Terminal settings, tmux files, keybinding files, status line commands, and hook snippets can expose usernames, hostnames, project paths, shell aliases, secrets in environment commands, and internal repository names. Notification commands and status line scripts may reveal task names, working directories, git branches, model names, costs, or local operational context. Remote terminal and SSH notification behavior can surface session activity on a local desktop; confirm the user is comfortable with that visibility. Public PR or issue notes should summarize symptoms and redacted settings, not paste complete dotfiles, shell history, terminal transcripts, or private hook scripts.
Prerequisites
  • Permission to edit user, local, or managed settings with autoMode blocks.
  • Inventory of trusted source control orgs, buckets, and internal domains.
  • Security stakeholder for managed permissions.deny hard blocks.
  • Claude Code on macOS, Linux, or WSL with sandbox dependencies installable.
  • Permission to edit project or managed settings.json sandbox blocks.
  • Inventory of bash commands agents run in CI and local workflows.
  • Security stakeholder for production repository policy sign-off.
  • Claude Code v2.1.91 or later on the machines that will click or open the link.
  • At least one prior interactive Claude Code session on each target machine so the claude-cli:// handler registers.
  • For repo links, a local clone where Claude Code has been run at least once so the owner/name slug resolves.
  • Permission to review runbook text, alert templates, and the decoded prompt before users press Enter.
  • Claude Code installed and runnable in the terminal, editor terminal, SSH session, or tmux/screen environment being reviewed.
  • The user's operating system, terminal emulator, shell, Claude Code version, and whether Claude Code is running locally, remotely, or inside tmux.
  • Permission to inspect redacted terminal settings, `~/.claude/settings.json`, `~/.claude/keybindings.json`, `~/.tmux.conf`, and notification hook snippets when relevant.
  • A concrete ergonomics symptom, such as Shift+Enter submitting, missing alerts, scrollback jumping, unreadable colors, Vim mode confusion, or shortcut conflicts.
Install————
Config————
Citations
ClaimUnclaimedUnclaimedUnclaimedUnclaimed

Signals

Loading live community signals…

More like this, weekly

A short, calm digest of reviewed Claude resources. Unsubscribe any time.