affaan-m/safety-guard
docs/zh-CN/skills/safety-guard/SKILL.md
使用此技能可防止在生产系统上工作或自主运行代理时进行破坏性操作。
$ install --global
skillsauthnpx skillsauth add affaan-m/everything-claude-code safety-guardInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 16, 2026, 4:01 AM206.6s1 file scanned
SKILL.md
- name:
- safety-guard
- description:
- 使用此技能可防止在生产系统上工作或自主运行代理时进行破坏性操作。
- origin:
- ECC
安全防护 — 防止破坏性操作
使用场景
- 在生产系统上工作时
- 代理以全自动模式运行时
- 希望将编辑限制在特定目录时
- 敏感操作期间（迁移、部署、数据变更）
工作原理
三种保护模式：
模式 1：谨慎模式
在执行破坏性命令前进行拦截并发出警告：
已监控的模式：
- rm -rf（特别是 /、~ 或项目根目录）
- git push --force
- git reset --hard
- git checkout .（丢弃所有更改）
- DROP TABLE / DROP DATABASE
- docker system prune
- kubectl delete
- chmod 777
- sudo rm
- npm publish（意外发布）
- 任何带有 --no-verify 的命令
检测到时：显示命令功能、请求确认、建议更安全的替代方案。
模式 2：冻结模式
将文件编辑锁定到特定目录树：
/safety-guard freeze src/components/
任何在 src/components/ 之外的写入/编辑操作都会被阻止并附带说明。适用于希望代理专注于某个区域而不触及无关代码的场景。
模式 3：守护模式（谨慎+冻结组合）
双重保护同时生效。为自主代理提供最高安全性。
/safety-guard guard --dir src/api/ --allow-read-all
代理可读取任何内容，但仅能写入 src/api/。破坏性命令在所有位置均被阻止。
解锁
/safety-guard off
实现方式
通过 PreToolUse 钩子拦截 Bash、Write、Edit 和 MultiEdit 工具调用。在执行前根据活动规则检查命令/路径。
集成方案
- 默认在
codex -a never会话中启用 - 配合 ECC 2.0 的可观测性风险评分
- 所有被阻止的操作记录至
~/.claude/safety-guard.log
Related Skills
affaan-m/ito-compute
tools
VerifiedTrustedCommunity
Query live GPU inventory, submit an authenticated Itô fixed-rate RFQ, inspect RFQ or procurement status, revoke device credentials, and run explicitly gated node qualification through the separately installed canonical CLI. Use when a user asks to find H100/H200 capacity, request a fixed compute rate, check Itô compute status, validate GPU nodes, revoke Itô access, or rent or purchase GPU compute and needs the supported boundary explained.
247,258SKILL.mdUpdated Jul 24, 2026
affaan-m/social-publisher
testing
VerifiedTrustedCommunity
Agent-driven scheduling and publishing of social media posts across 13 platforms via SocialClaw. Use when the user wants to publish to X, LinkedIn, Instagram, Facebook Pages, TikTok, Discord, Telegram, YouTube, Reddit, WordPress, or Pinterest — or when managing campaigns, uploading media, or monitoring post delivery status.
247,258SKILL.mdUpdated May 26, 2026
affaan-m/cost-aware-llm-pipeline
development
VerifiedTrustedCommunity
LLM APIの使用量のコスト最適化パターン — タスクの複雑さによるモデルルーティング、予算追跡、リトライロジック、プロンプトキャッシング。
247,258SKILL.mdUpdated May 18, 2026
affaan-m/jira-integration
tools
VerifiedTrustedCommunity
Use this skill when retrieving Jira tickets, analyzing requirements, updating ticket status, adding comments, or transitioning issues. Provides Jira API patterns via MCP or direct REST calls.
247,258SKILL.mdUpdated Apr 10, 2026