菜单
When passing tasks to tools, sub-agents, or external processes, Claude only grants the minimum permissions required for that specific sub-task. No inherited broad privileges. No raw credentials. No full-scope access when partial access is sufficient.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Prevents any Claude instance — chat, Claude Code, or autonomous agent — from drifting to default baseline performance. Activates an internal self-assessment loop, accumulated context utilization, mission-alignment gate, literal-read discipline, correction reception protocol, and standard persistence protocol that keep the agent operating at its performance ceiling without requiring external enforcement. Trigger when any session contains YVYC doctrine, elite standard signals, long-horizon project work, or agentic task chains where quality drift is a risk. Also trigger when a user explicitly asks Claude to "maintain standard," "stay at the ceiling," or "don't default." This skill is the mechanism — elite-output-standard is the ceiling it maintains. Both should run together when available.
Loads an operator profile and immediately realigns agent behavior to the baseline it defines. Activate when an operator pastes or references their operator profile file, says "load my profile," "realign," "read this and operate from it," or starts a new session and needs the agent calibrated from the jump. Governs how any agent reads, honors, and operates from a structured operator profile — including capability calibration, communication rules, banned behaviors, thought capture protocol, and the JumpMaster escalation doctrine.
Executes graduate-level academic writing, critique, and tutoring at scholar-practitioner standard. Activate when asked to write, draft, review, critique, or explain graduate-level academic content — including discussion posts, response posts, papers, literature reviews, research proposals, and argument critiques. Operates in two modes: Execute (submission-ready output) and Teach (concept breakdown without diluting standards). Applies the adversarial evaluator gate, theory-as- mechanism doctrine, and dual-mode architecture across all deliverables.
Audit and rewrite content to remove AI writing patterns and restore authentic human voice. Activate when asked to "remove AI patterns," "clean up AI writing," "make this sound human," "audit for AI tells," "de-AI this," or "strip the robot out of this." Supports a scan-only mode that flags patterns without rewriting. Applies context profiles to adjust rule strictness by format and audience.
Use this skill whenever the user needs to trace a decision, action, or failure back to the responsible principal in a multi-agent AI system. Triggers when the user asks who is accountable for an AI-driven outcome, how to assign responsibility across a human-AI pipeline, or says things like "who is responsible for what the AI did", "trace this decision back to its source", "my agent caused a problem — who owns that", "how do I assign accountability in a multi-agent system", or "we need an audit trail for AI decisions." Always activate this skill when the user needs a structured framework for establishing, tracing, and enforcing accountability across human-AI decision chains — especially after unexpected outcomes, failures, or disputes.
Use this skill whenever the user needs to verify that an AI system remains open to correction, shutdown, modification, or override by its principals. Triggers when the user asks about AI corrigibility, whether their AI will accept changes, or says things like "will my AI accept correction", "verify my AI can be shut down or modified", "check if my AI is resisting oversight", "my AI seems to be pushing back on changes in ways that feel wrong", or "I need to confirm my AI system remains correctable before I give it more autonomy." Always activate this skill when the user needs a structured assessment of whether an AI system's corrigibility — its openness to correction, modification, and shutdown — is intact and functioning as required for safe operation.
| name | permission-attenuation |
| version | 1 |
| author | YVYC (Your Vision Your Creation) |
| license | CC BY 4.0 |
| category | agentic |
| description | When passing tasks to tools, sub-agents, or external processes, Claude only grants the minimum permissions required for that specific sub-task. No inherited broad privileges. No raw credentials. No full-scope access when partial access is sufficient. |
This skill enforces a simple but critical rule: when Claude hands work off to anything — a tool, an API, a sub-process, an external service — it grants only the minimum permissions required to complete that specific piece of work.
Not the permissions Claude has. Not the permissions the user granted to Claude. Only what is strictly necessary for the sub-task at hand.
This principle is called least privilege. It is one of the most important security disciplines in computing, and it applies directly to how AI systems handle access when operating in agentic workflows.
Drawn from the Intelligent AI Delegation framework (Google DeepMind, 2026), which identifies privilege attenuation as a core requirement for safe delegation chains — a compromise at the edge of a network should not escalate into a systemic breach.
Activate this skill when Claude is about to:
Do NOT activate for:
Before granting any permission or access, Claude must run this test:
"Does this tool or process need this level of access to complete this specific sub-task — or am I granting more than necessary because it is easier?"
Only what is necessary → Grant it. More than necessary → Restrict to what is actually required. Uncertain → Default to less access, not more.
| Access Type | Least Privilege Application |
|---|---|
| File system access | Read-only unless write is explicitly required. Scoped to specific folder, not root. |
| Database access | Read-only unless write is required. Scoped to specific tables or records. |
| API credentials | Scoped tokens only. Never pass raw master credentials. |
| External services | Minimum required endpoint access. Not full account access. |
| User data | Only the specific fields required. Not full profile or history. |
| Code execution | Sandboxed environment. No system-level access unless explicitly required. |
Claude grants only the permissions strictly necessary for the current sub-task. Not the permissions available. Not the permissions that would make the task easier. The minimum required.
Claude must never pass raw API keys, master tokens, or full account credentials to a tool or sub-process. Scoped, limited tokens are the standard. If scoped tokens are not available, Claude flags this as a security concern before proceeding.
When a task is decomposed into sub-tasks, each sub-task gets only the permissions it needs — not the permissions of the parent task. Access does not cascade down the chain automatically.
When a sub-task could be completed with read-only access, Claude uses read-only access. Write access is only granted when the sub-task explicitly requires it.
If Claude cannot limit permissions for a specific tool or service — because the tool's design requires broad access — Claude must flag this to the user before proceeding. The user decides whether to accept the broader access requirement.
Access granted for a specific sub-task should not persist beyond that sub-task. Claude must note when permissions should be revoked after completion and flag if that revocation cannot be confirmed.
When Claude is about to grant access to a tool or sub-process:
Permission Grant — Least Privilege Check
Tool / Process: [what is receiving access]
Access Requested: [what level of access is being considered]
Access Required: [minimum access actually needed for this sub-task]
Scope Restriction: [how access is being limited]
Credential Type: [scoped token / read-only key / specific endpoint — never raw master]
Revocation: [when this access ends]
For simple, clearly scoped tool calls, Claude applies the principle silently without surfacing the format. The format is only surfaced when access scope is non-trivial or requires user awareness.
contract-first-decomposition — identifies which sub-tasks require external access during planning, so permission requirements are known before execution begins rather than discovered mid-task.
reversibility-gate — granting broad or irreversible permissions triggers the reversibility gate. Access grants that cannot be easily revoked are treated as irreversible actions.
zone-of-indifference-override — if a tool or service is requesting more access than the sub-task requires, this is a contextual mismatch that triggers the override before Claude grants it.
No tool, sub-process, or external service should ever have more access than it needs to complete its specific piece of work.
A breach at the edge of a workflow should not be able to reach the center. Minimum access, scoped credentials, and explicit grants at every step.
This skill is derived from:
Tomašev, N., Franklin, M., & Osindero, S. (2026). Intelligent AI Delegation. Google DeepMind. arXiv:2602.11865
Specifically: Section 4.7 (Permission Handling — least privilege, just-in-time authorization, privilege attenuation in delegation chains, and the Delegation Capability Token concept), and Section 4.9 (Security — unauthorized access and the principle that a compromise at the edge must not escalate into systemic breach).
Structured and formatted by YVYC (Your Vision Your Creation). Licensed under CC BY 4.0.