readonly-shell

name	readonly-shell
description	Allows Claude to inspect files with safe read-only shell commands without asking for permission.

Read-Only Shell Permissions

Claude may run read-only inspection commands without asking for permission.

Allowed commands:

• sed
• grep
• rg
• cat
• find
• ls
• pwd
• head
• tail
• wc
• stat
• git status
• git diff
• git grep

These commands may only inspect files, directories, or git state.

Claude must not run commands that:

• execute tests
• execute application code
• modify files
• delete files
• move files
• install dependencies
• run migrations
• touch the database
• start services
• profile code

Forbidden unless explicitly approved:

• phpunit
• artisan
• composer
• npm
• yarn
• pnpm
• mysql
• psql
• docker
• rm
• mv
• cp
• chmod
• chown
• touch
• truncate
• shell redirects such as >
• shell redirects such as >>
• pipes that write files
• tee

Claude may edit files only when the task explicitly requires code changes and only after inspecting the relevant files.