guard

Block destructive shell and version-control commands with configurable policies and audit logs.

204|14|Updated Mar 25, 2026

Search Tags:#git #devops #security #audit #bash #safety #guardrails

Ready to run

npx skills add https://github.com/garagon/nanostack --skill guard-garagon

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: guard
Source: https://github.com/garagon/nanostack/tree/main/guard
Command: npx skills add https://github.com/garagon/nanostack --skill guard-garagon

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Guard prevents accidental destructive operations and unsafe changes when working near production or other sensitive systems by adding on-demand safety checks and interactive confirmations to command execution workflows.

Core Features & Use Cases

Modes: careful (warn before risky commands), freeze (block writes outside a defined scope), and unfreeze (remove freeze).
PreTool Hook: integrates a PreToolUse hook that runs a check script to apply a three-tier policy: allowlist, in-project detection, and pattern matching against configurable block/warn rules.
Gates & Auditing: enforces sprint phase, budget gates, and concurrency safeguards, suggests safer alternatives for blocked commands, and records audit logs for evaluated commands.
Use Case: a developer about to run a force push or a mass-delete command receives an immediate block or explicit warning with a safer alternative and an audit trail, while a freeze scope prevents accidental edits outside the current focus area.

Quick Start

Use the guard skill in your session by invoking /guard to enable careful mode so every risky shell or git command is checked before execution.

Frequently Asked Questions about guard

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I prevent destructive shell commands from running near production environments?▼

You can prevent destructive shell commands by applying a PreToolUse hook that pattern-matches risky commands, checks in-repo paths, and executes a three-tier policy to block, warn, or allow the operation before it runs near production.

How do I block git force push and mass-delete commands in interactive AI agent sessions?▼

To block git force push and mass-delete commands in interactive AI agent sessions, apply configurable block and warn rules that pattern-match unsafe git operations, offering safer alternatives and explicit user confirmations before execution.

Can I restrict file edits to a specific scope during an active development sprint?▼

Yes, you can restrict file edits by enabling freeze mode to block writes outside a defined scope, enforcing sprint phase and budget gates so accidental edits outside the current focus area are prevented.

Does this safety guardrail approach support allowlists and audit logging for executed commands?▼

Yes, this safety guardrail approach supports allowlists to pre-approve safe commands and records audit logs for evaluated shell and version-control commands, ensuring a traceable audit trail for developer workflows.

What is the best way to add safety checks to CI/CD pipelines without breaking developer workflows?▼

The best way to add safety checks to CI/CD pipelines without breaking workflows is using careful mode, which warns before risky commands execute, suggests safer alternatives, and enforces concurrency safeguards while maintaining developer velocity.