Menu
Use this skill to prevent destructive operations when working on production systems or running agents autonomously.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Pi Coding Agent integration. Generate multi-agent team/chain configs and damage-control safety rules. Triggers on: pi, Pi agent, multi-agent, chain config, damage control.
Switch between development modes. Use /apex:mode to change mode or check current mode. Triggers on: switch mode, change mode, /apex:mode, what mode am I in.
Spec-driven development workflow. Propose features with specs, design docs, and tasks before writing code. Triggers on: /apex:spec, propose, write spec, design feature.
REST API design patterns including resource naming, status codes, pagination, filtering, error responses, versioning, and rate limiting for production APIs.
Capture architectural decisions made during Claude Code sessions as structured ADRs. Auto-detects decision moments, records context, alternatives considered, and rationale. Maintains an ADR log so future developers understand why the codebase is shaped the way it is.
Backend architecture patterns, API design, database optimization, and server-side best practices for Node.js, Express, and Next.js API routes.
| name | safety-guard |
| description | Use this skill to prevent destructive operations when working on production systems or running agents autonomously. |
| metadata | {"origin":"ECC"} |
| apex-version | 1.0 |
| apex-id | ecc:safety-guard |
| apex-category | domain |
| apex-compatibility | ["ecc","superpowers","gsd"] |
| apex-lifecycle | {"phase":["execute"]} |
Three modes of protection:
Intercepts destructive commands before execution and warns:
Watched patterns:
- rm -rf (especially /, ~, or project root)
- git push --force
- git reset --hard
- git checkout . (discard all changes)
- DROP TABLE / DROP DATABASE
- docker system prune
- kubectl delete
- chmod 777
- sudo rm
- npm publish (accidental publishes)
- Any command with --no-verify
When detected: shows what the command does, asks for confirmation, suggests safer alternative.
Locks file edits to a specific directory tree:
/safety-guard freeze src/components/
Any Write/Edit outside src/components/ is blocked with an explanation. Useful when you want an agent to focus on one area without touching unrelated code.
Both protections active. Maximum safety for autonomous agents.
/safety-guard guard --dir src/api/ --allow-read-all
Agents can read anything but only write to src/api/. Destructive commands are blocked everywhere.
/safety-guard off
Uses PreToolUse hooks to intercept Bash, Write, Edit, and MultiEdit tool calls. Checks the command/path against the active rules before allowing execution.
codex -a never sessions~/.claude/safety-guard.log