Safety Guard
- 1.4k installs
- 238k repo stars
- Updated August 5, 2026
- affaan-m/ecc
This is a copy of safety-guard by affaan-m - installs and ranking accrue to the original listing.
safety-guard is an agent skill that blocks destructive commands and restricts file edits to approved directories for developers who run autonomous agents against production systems or sensitive repositories.
About
safety-guard is an ECC protection skill for autonomous agent runs on production systems and sensitive repositories. It provides three protection modes: Careful mode detects destructive commands such as rm -rf, git push --force, DROP TABLE, kubectl delete, and --no-verify hooks before execution and prompts for confirmation with safer alternatives; Freeze mode locks edits to specific directory trees via commands like freeze src. Developers reach for safety-guard during full-auto agent sessions, migrations, deploys, and data changes where a mistaken shell or Git command could wipe state. The skill watches roughly a dozen high-risk command patterns and offers directory-scoped edit locks instead of relying on post-hoc review.
- Three protection modes: Careful, Freeze, and Guard
- Intercepts 15+ destructive patterns including rm -rf, git push --force, DROP TABLE, docker prune, and npm publish
- Freeze Mode locks all file edits to a single directory tree
- Guard Mode combines command watching with directory restrictions for full-auto agent safety
- Requires explicit confirmation with safer-alternative suggestions before any risky action
Safety Guard by the numbers
- 1,371 all-time installs (skills.sh)
- +83 installs in the week ending Aug 4, 2026 (Skillselion tracking)
- Data as of Aug 5, 2026 (Skillselion catalog sync)
npx skills add https://github.com/affaan-m/ecc --skill safety-guardAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 1.4k |
|---|---|
| repo stars | ★ 238k |
| Last updated | August 5, 2026 |
| Repository | affaan-m/ecc ↗ |
How do you stop agents from running destructive shell commands?
Block destructive commands and limit agent edits to approved directories when running autonomous agents or touching production systems.
Who is it for?
Developers running full-auto coding agents against production repos, databases, or Kubernetes clusters who need pre-execution guardrails.
Skip if: Developers working only in local throwaway sandboxes where destructive commands carry no recovery risk.
When should I use this skill?
Autonomous agent mode is active, production systems are touched, or edits must be restricted to approved directories.
What you get
Blocked-command warnings, user confirmations, safer command alternatives, and frozen directory edit locks.
- Command interception warnings
- Directory freeze locks
- Safer alternative command suggestions
By the numbers
- Provides 3 protection modes including Careful command interception and Freeze directory locking
- Monitors 12+ destructive command patterns including rm -rf, git push --force, and DROP TABLE
Files
Safety Guard — 破壊的な操作の防止
使用するタイミング
- 本番システムでの作業時
- エージェントが自律的に動作している場合（フルオートモード）
- 特定のディレクトリへの編集を制限したい場合
- センシティブな操作時（マイグレーション、デプロイ、データ変更）
動作の仕組み
3つの保護モードがあります:
モード1: Careful モード
実行前に破壊的なコマンドを検知して警告します:
監視するパターン:
- rm -rf（特に /、~、またはプロジェクトルート）
- git push --force
- git reset --hard
- git checkout .（全変更を破棄）
- DROP TABLE / DROP DATABASE
- docker system prune
- kubectl delete
- chmod 777
- sudo rm
- npm publish（誤公開）
- --no-verify を含む全コマンド検知した場合: コマンドの内容を示し、確認を求め、より安全な代替手段を提示します。
モード2: Freeze モード
特定のディレクトリツリーへのファイル編集をロックします:
/safety-guard freeze src/components/src/components/ 外への Write/Edit は説明付きでブロックされます。エージェントを特定の領域に集中させ、無関係なコードに触れないようにしたい場合に便利です。
モード3: Guard モード（Careful + Freeze の組み合わせ）
両方の保護が有効になります。自律エージェントのための最大安全モードです。
/safety-guard guard --dir src/api/ --allow-read-allエージェントはすべてを読み取れますが、src/api/ にのみ書き込めます。破壊的なコマンドはどこでもブロックされます。
ロック解除
/safety-guard off実装
PreToolUse フックを使用して Bash、Write、Edit、MultiEdit ツールの呼び出しを検知します。実行前に、アクティブなルールに対してコマンド/パスを確認します。
統合
codex -a neverセッションでデフォルトで有効化する- ECC 2.0 の可観測性リスクスコアリングと組み合わせる
- ブロックされた全アクションを
~/.claude/safety-guard.logに記録する
Related skills
Entra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets484k1.3kAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.484k1.3k
Openclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72
Better Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.80.9k206
Firebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.80.4k397
Audit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.6k85How it compares
Pick safety-guard over manual review prompts when autonomous agents need automatic pre-execution blocks on shell, Git, and database commands.
FAQ
What commands does safety-guard Careful mode block?
safety-guard Careful mode watches patterns including rm -rf, git push --force, git reset --hard, DROP TABLE, kubectl delete, docker system prune, chmod 777, sudo rm, npm publish, and any command containing --no-verify, then shows the command and asks for confirmation.
How does safety-guard Freeze mode protect directories?
safety-guard Freeze mode locks edits to a specified directory tree, for example freezing src, so autonomous agents cannot modify files outside the approved path during sensitive operations.