Username Guard
- Updated May 30, 2026
- karashiiro/karashiiro-marketplace
username-guard is an agent skill that blocks file modifications when written content contains the current $USER as a whole word.
About
username-guard is a Claude Code–style pretooluse security plugin that intercepts file modifications before they execute and rejects any write whose content includes the machine’s current username ($USER) as a standalone token, case-insensitively. Developers who let agents batch-edit configs, docs, or scaffolding need this kind of guard because models often mirror path segments, home-directory hints, or local account names into committed files without asking. The skill does not rewrite content—it fails closed on risky output, which pairs well with review and secret-scanning steps later in the journey. It is lightweight (hook-only), so it slots into agent workflows across Build, Ship, and Operate whenever automated filesystem tools run. Treat it as baseline hygiene alongside.gitignore rules and env-based secrets, not as a substitute for redacting tokens or PII in prompts.
- Pretooluse hook runs before file-modification tools apply content
- Blocks writes when body contains the current $USER as a whole word (case-insensitive)
- MIT-licensed marketplace plugin (v1.1.0) tagged hook, privacy, and security
- Whole-word matching reduces false positives versus naive substring scans
- Agent-side policy layer—no network calls required to enforce the rule
Username Guard by the numbers
- Data as of Jul 7, 2026 (Skillselion catalog sync)
/plugin marketplace add karashiiro/karashiiro-marketplace/plugin install username-guard@karashiiro-marketplaceAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Last updated | May 30, 2026 |
|---|---|
| Repository | karashiiro/karashiiro-marketplace ↗ |
What it does
Stop your coding agent from writing your OS username into repo files, logs, or configs during automated edits.
Who is it for?
Best when you use agent file-write tools and want a zero-config privacy rail against accidental username leakage.
Skip if: Skip if you only need secret/API-key scanning (use dedicated secret tools) or workflows that never expose $USER in agent-writable content paths.
When should I use this skill?
Agent is about to modify files and you want to block content that contains the current username as a whole word.
What you get
Risky file writes are stopped at the tool boundary so you can fix or redact content before anything is saved or committed.
- Blocked unsafe writes
- Enforced username-free file content policy at tool boundary
By the numbers
- Version 1.1.0
- Whole-word case-insensitive $USER match
- MIT license
Files
Blocks file modifications whose written content contains the current username ($USER) as a whole word (case-insensitive)
username-guard
Source: ./plugins/username-guard
{ "name": "username-guard", "author": { "name": "karashiiro" }, "source": "./plugins/username-guard", "license": "MIT", "version": "1.1.0", "category": "security", "keywords": [ "hook", "security", "pretooluse", "username", "privacy" ], "description": "Blocks file modifications whose written content contains the current username ($USER) as a whole word (case-insensitive)" }
Related skills
Entra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets484k1.3kAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.484k1.3k
Openclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72
Better Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.80.9k206
Firebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.80.4k397
Audit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.6k85How it compares
Use as a lightweight pretooluse privacy hook instead of relying on post-hoc grep after the agent already saved the file.
FAQ
Who is username-guard for?
Developers and small teams running Claude Code or similar agents with filesystem tools who share repos publicly and worry about local account names ending up in commits.
When should I use username-guard?
Enable it during Build when agents scaffold docs and configs, during Ship before you merge agent-generated patches, and during Operate when agents tune deployment or monitoring files—anytime pretooluse hooks can inspect write payloads.
Is username-guard safe to install?
It is a local policy hook described as MIT-licensed marketplace security tooling; review the Security Audits panel on this Prism page and your org’s hook policy before enabling pretooluse plugins.