guardrails

A safety layer for Claude Code, a coding assistant, that checks shell commands before they run. It blocks catastrophic commands and asks for confirmation when file operations may affect locations outside the allowed workspace.

In plain words
What is it for?
Safely running automated shell commands, especially commands involving deletion, repository cleanup, disk operations, or privileged interpreters.
Why use it?
It reduces the risk of an unsupervised coding assistant deleting, overwriting, or modifying important files.

Plugin for Claude Code

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Claude Code
/plugin marketplace add fvadicamo/dev-agent-skills
agentmods
npx agentmods add plugins/fvadicamo/dev-agent-skills/guardrails
Clone the repo
git clone --depth 1 https://github.com/fvadicamo/dev-agent-skills

Made for: Claude Code.

Per session not measured What this adds to a session before it is invoked.
When invoked not measured Not applicable: nothing here is loaded into a session.
Security scan C 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Security

Grade C, and why

guardrails scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Recursive force deletehighDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

"description": "Safety guardrails for running Claude Code with reduced supervision. The guard-destructive PreToolUse hook matches against a normalized view of each command (heredoc bodies and comments stripped, quoted st
plugins/guardrails/.claude-plugin/plugin.json · 10 lines

What it actually says

{
  "name": "guardrails",
  "description": "Safety guardrails for running Claude Code with reduced supervision. The guard-destructive PreToolUse hook matches against a normalized view of each command (heredoc bodies and comments stripped, quoted strings neutralized except interpreter arguments like ssh / sh -c / eval / su / doas), so a command that merely mentions a destructive pattern is not flagged. It hard-blocks catastrophic Bash commands (rm -rf /, rsync --delete, docker volume rm) and makes rm/rmdir scope-aware: operations whose operands all resolve inside the allowed workspace (the session project root, temp dirs, any $GUARD_ALLOWED_EXTRA root, or a variable assigned from a bare mktemp earlier in the same command) run silently, while anything outside it (or any glob/variable/escape it cannot resolve) raises a single reflective confirmation. git reset --hard / clean / restore, shred, dd, mkfs still always prompt.",
  "version": "1.7.6",
  "author": {
    "name": "Francesco Vadicamo",
    "email": "[email protected]"
  }
}
Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 10 lines scan C 1a73bf768a8f

Subscribe to this mod's changes

guardrails is a plugin published in the GitHub repository fvadicamo/dev-agent-skills (72 stars, last pushed 6d ago), licensed MIT. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other plugins, from other repositories

cpp

Two complementary modern-C++ (C++17) native-addon skills for Claude Code. resource-review traces object and resource lifetimes and reports only proven memory/resource defects (use-after-free, double-free, leaks, out-of-bounds, integer overflow, data races, Node-API handle/reference/threadsafe-function misuse), using a.

photostructure/coding-skills · not measured

rust

A practical Rust project-setup skill for Claude Code. It creates, assesses, or improves stable Rust projects using profile-aware Cargo workspace and feature design, explicit edition/MSRV/toolchain policy, strict but usable rustc/Clippy/rustfmt configuration, layered testing and CI, idiomatic ownership and API design…

photostructure/coding-skills · not measured

coding

Opinionated Claude Code workflow skills: clear and unambiguous technical writing (write-clearly), iterative planning (replan), proof-based code review (review, review-staged, second-opinion), disciplined Conventional-Commit staging (gitplan, stage), and the Technical Project Plan workflow (tpp, handoff…

photostructure/coding-skills · not measured

security

Complementary JavaScript/TypeScript web and Electron security skills for Claude Code. web-security-review traces data flow and reports only proven vulnerabilities. web-security-hardening assesses applicable OWASP ASVS 5.0.0 and Electron Security Checklist controls using evidence-backed Met/Gap/Not applicable/Needs…

photostructure/coding-skills · not measured

braintrust

Enables AI agents to use Braintrust for LLM evaluation, logging, and observability. Provides correct API usage, working examples, and helper scripts for common operations.

parcadei/Continuous-Claude-v3 · not measured

rails-consultant marketplace

Plugin marketplace listing 1 plugin: rails-consultant.

thoughtbot/rails-consultant · not measured