Menu
Check shell commands for prohibited utilities in executable positions and suggest approved replacements. Trigger automatically before running or proposing commands that may use grep, find, cat, ls, or du.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
| name | cmd-guard |
| description | Check shell commands for prohibited utilities in executable positions and suggest approved replacements. Trigger automatically before running or proposing commands that may use grep, find, cat, ls, or du. |
Run the checker before executing a shell command. It parses text only and never executes it.
Start in advisory mode so findings can be reviewed. Use --enforce only when the workflow explicitly requires blocking; violations then exit with status 2.
python3 scripts/check_command.py "find . -name '*.py' | grep test"
python3 scripts/check_command.py --enforce < command.txt
Read the deterministic JSON and replace each reported token with its suggested utility.
Supported grammar includes simple commands, assignments, redirections and heredocs, pipelines and list separators, if/while/until command positions, groups, function definitions, the sudo/env/command/time wrappers, and command, backtick, or process substitutions. Arithmetic expansion is treated as data.
Inspect command and backtick substitutions inside unquoted heredoc bodies; keep quoted bodies and all heredoc delimiter words literal. Parse separate or attached env -S strings recursively. Treat command -v/-V and sudo -l/-e operands as non-executed data only when those modes occur before the command word. Any expansion inside a command word makes the result indeterminate, while the same expansion in a known command's argument does not.
The JSON always includes status, mode, requested_mode, indeterminate, and violations. For unsupported grammar such as case, for, select, coproc, [[...]], here-strings, or parameter expansion, status is indeterminate, mode falls back to advisory, and the checker never blocks even when --enforce was requested. Treat that result as requiring manual review; this checker is not a complete Bash parser.
Generates a Context Snapshot (Why/rationale + file changes) before /compact to preserve important decision history across Claude Code sessions. Use when running /compact or when you need to save session context. Hooks auto-intercept both manual and auto-compact.
Extract keyframes from MP4/GIF/MOV video files into a single strip image for Claude to analyze. Use when the user shares a video file and wants to understand animation behavior, UI transitions, or visual bugs that are hard to describe with static screenshots.
Validate commit message structure, required Codex co-author attribution, and staged-path breadth. Use before creating a Git commit or reviewing commit readiness.
Run long local commands with live combined output, persistent logs, idle reporting, exit-code propagation, and distilled JSON evidence. Use for builds, tests, or other verbose tasks that need monitoring.
Monitor GitHub Actions CI/CD workflows after git push. ALWAYS invoke this skill automatically immediately after any successful `git push` command — do not wait for the user to ask. Also invoke when the user says monitor CI, check if CI passed, watch the workflow, CI の結果を確認, ワークフローを監視, or provides a GitHub Actions URL. This skill is essential after pushing code, Claude must verify CI results proactively so the user never has to manually check GitHub.