Audit Permissions

It runs in three phases: first you review candidates and promote what makes sense, then it automatically strips out redundant local permissions that are now covered globally, and finally it flags security risks (like broad curl or rm permissions), policy conflicts with your CLAUDE.md preferences, and one-off cruft like hardcoded paths. The workflow is thoughtfully structured around getting your input at decision points while automating the mechanical cleanup work. Especially useful if you've been adding permissions ad-hoc across projects and want to consolidate without manually diffing dozens of settings files.