affaan-m/safety-guard
docs/zh-CN/skills/safety-guard/SKILL.md
使用此技能可防止在生产系统上工作或自主运行代理时进行破坏性操作。
$ install --global
skillsauthnpx skillsauth add affaan-m/everything-claude-code safety-guardInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 16, 2026, 4:01 AM206.6s1 file scanned
SKILL.md
- name:
- safety-guard
- description:
- 使用此技能可防止在生产系统上工作或自主运行代理时进行破坏性操作。
- origin:
- ECC
安全防护 — 防止破坏性操作
使用场景
- 在生产系统上工作时
- 代理以全自动模式运行时
- 希望将编辑限制在特定目录时
- 敏感操作期间（迁移、部署、数据变更）
工作原理
三种保护模式：
模式 1：谨慎模式
在执行破坏性命令前进行拦截并发出警告：
已监控的模式：
- rm -rf（特别是 /、~ 或项目根目录）
- git push --force
- git reset --hard
- git checkout .（丢弃所有更改）
- DROP TABLE / DROP DATABASE
- docker system prune
- kubectl delete
- chmod 777
- sudo rm
- npm publish（意外发布）
- 任何带有 --no-verify 的命令
检测到时：显示命令功能、请求确认、建议更安全的替代方案。
模式 2：冻结模式
将文件编辑锁定到特定目录树：
/safety-guard freeze src/components/
任何在 src/components/ 之外的写入/编辑操作都会被阻止并附带说明。适用于希望代理专注于某个区域而不触及无关代码的场景。
模式 3：守护模式（谨慎+冻结组合）
双重保护同时生效。为自主代理提供最高安全性。
/safety-guard guard --dir src/api/ --allow-read-all
代理可读取任何内容，但仅能写入 src/api/。破坏性命令在所有位置均被阻止。
解锁
/safety-guard off
实现方式
通过 PreToolUse 钩子拦截 Bash、Write、Edit 和 MultiEdit 工具调用。在执行前根据活动规则检查命令/路径。
集成方案
- 默认在
codex -a never会话中启用 - 配合 ECC 2.0 的可观测性风险评分
- 所有被阻止的操作记录至
~/.claude/safety-guard.log
Related Skills
affaan-m/unified-memory
development
VerifiedTrustedCommunity
Share durable, inspectable context and handoffs between Claude, Codex, Hermes, Cursor, OpenCode, and other agents through the local ECC Memory Vault. Use when an agent must save work state, transfer context, resume another agent's task, or search shared project knowledge.
234,238SKILL.mdUpdated Jul 28, 2026
affaan-m/contract-first
development
VerifiedTrustedCommunity
Use when multiple consumers and providers must evolve an API or event schema without field drift, integration surprises, or one side silently redefining the interface.
234,238SKILL.mdUpdated Jul 28, 2026
affaan-m/ito-compute
tools
VerifiedTrustedCommunity
Query live GPU inventory, submit an authenticated Itô fixed-rate RFQ, inspect RFQ or procurement status, and run explicitly gated node qualification through the separately installed canonical CLI. Use when a user asks to find H100/H200 capacity, request a fixed compute rate, check Itô compute status, or validate GPU nodes.
234,238SKILL.mdUpdated Jul 24, 2026
affaan-m/continuous-learning-v2
data-ai
VerifiedTrustedCommunity
Instinct-based learning system that observes sessions via hooks, creates atomic instincts with confidence scoring, and evolves them into skills/commands/agents. v2.1 adds project-scoped instincts to prevent cross-project contamination.
234,238SKILL.mdUpdated Mar 27, 2026