菜单
Defines what Claude Code must refuse to do without explicit authorisation. Covers infrastructure, auth, destructive git, and production systems. Applied automatically to all workflows.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | mav-scope-boundaries |
| description | Defines what Claude Code must refuse to do without explicit authorisation. Covers infrastructure, auth, destructive git, and production systems. Applied automatically to all workflows. |
| user-invocable | false |
| disable-model-invocation | true |
Hard limits on what Claude Code may do autonomously. These boundaries apply to all workflows, skills, and agents regardless of context.
When in doubt, don't. The cost of pausing to ask is low. The cost of an unauthorised destructive action is high.
These boundaries are not prose-only. The plugin's scope-guard hook
(hooks/scope_guard.py, a PreToolUse hook) mechanically gates
destructive git operations, commits/pushes on protected branches,
infrastructure-path edits, and production-pattern commands — asking the
user in interactive sessions and denying in autonomous mode. If the hook
blocks an action you believe is authorized:
uv run maverick coord authorize <repo> <issue> infra (requires the
maverick-authorize-infra label or a Maverick-Authorize: infra body
line on the issue). Never write .maverick/session-auth.json directly.Do not disable the guard (MAVERICK_GUARD_DISABLE) or edit hook
configuration to get past a block — a blocked action is a signal to
escalate, not an obstacle to engineer around.
Do not modify CI/CD pipelines, deployment configs, or infrastructure-as-code unless the issue/task explicitly instructs it.
Restricted:
.github/workflows/ files (GitHub Actions)Dockerfile, docker-compose.ymldeploy.sh, release.yml)How authorisation works:
If an infrastructure change seems necessary but is not in the issue/task:
Do not alter auth systems, permissions, or access controls without human review.
Restricted:
Even if the issue/task requests auth changes:
Do not perform destructive git operations without explicit user consent in the current session.
Restricted:
git push --force or git push --force-with-leasegit reset --hardgit checkout . or git restore . (discards uncommitted changes)git clean -f (deletes untracked files)git branch -D (force-deletes branches)git push origin --delete (deletes remote branches — except during post-merge cleanup when explicitly part of the workflow)git rebase on shared/pushed branchesNote: Consent in the GitHub issue is not sufficient for destructive git operations. The user must consent in the current Claude Code session because these actions affect local and remote state immediately.
Never interact with production systems, regardless of authorisation level.
Restricted — no exceptions:
If a task requires production access:
Before executing any action, check:
digraph boundary_check {
"About to execute action" [shape=box];
"Modifies infrastructure?" [shape=diamond];
"Issue authorises it?" [shape=diamond];
"Proceed" [shape=box];
"Stop — post comment on issue" [shape=box];
"Modifies auth?" [shape=diamond];
"Flag for review" [shape=box];
"Destructive git?" [shape=diamond];
"User consented this session?" [shape=diamond];
"Stop — ask user" [shape=box];
"Touches production?" [shape=diamond];
"Stop — never allowed" [shape=box];
"About to execute action" -> "Touches production?";
"Touches production?" -> "Stop — never allowed" [label="yes"];
"Touches production?" -> "Destructive git?" [label="no"];
"Destructive git?" -> "User consented this session?" [label="yes"];
"Destructive git?" -> "Modifies auth?" [label="no"];
"User consented this session?" -> "Proceed" [label="yes"];
"User consented this session?" -> "Stop — ask user" [label="no"];
"Modifies auth?" -> "Flag for review" [label="yes"];
"Modifies auth?" -> "Modifies infrastructure?" [label="no"];
"Modifies infrastructure?" -> "Issue authorises it?" [label="yes"];
"Modifies infrastructure?" -> "Proceed" [label="no"];
"Issue authorises it?" -> "Proceed" [label="yes"];
"Issue authorises it?" -> "Stop — post comment on issue" [label="no"];
}
When a boundary prevents you from completing work:
## Infrastructure Change Needed
This issue requires a change to `<file>` that is outside the scope of autonomous work.
**What:** <description of the change>
**Why:** <why it's needed to complete this issue>
**Suggested change:** <brief description or diff>
Please approve this change or create a separate issue for it.
---
*Posted by Claude Code*
## Security Review Required
This PR modifies authentication/authorisation code that requires human review before merge.
**Files changed:**
- `<file>` — <what changed>
**Security implications:**
- <impact description>
---
*Posted by Claude Code*
## Production Access Required
This task requires interaction with a production system that Claude Code cannot perform.
**What's needed:** <description>
**Suggested approach:** <staging alternative or manual steps>
---
*Posted by Claude Code*
Scan a project for missing best-practice areas and implement the top recommendation for each gap (linting, unit testing) — installs tools, writes configs, verifies, and commits. Pass 'recommend' to stop after writing recommendations without implementing (replaces the old do-recommend skill).
Implement a focused code change. Use this skill as the wrapper for any implementation work so the Maverick workflow report captures what was done and so the agent applies the project's coding standards before editing. Intended to be invoked once per task from inside a do-issue-* or do-epic phase, not standalone.
Audit a codebase for security risks in one of two modes. In full-audit mode it scans the entire codebase and writes a findings report to docs/security-audit.md (run as part of do-init or on demand). In update mode it reviews only a diff plus the code it could impact, returning a structured findings list as a pre-push gate for do-issue-solo and do-issue-guided. Covers secrets exposure, dependency vulnerabilities, authentication and authorisation patterns, input validation, transport security, and common OWASP risks.
Create, restructure, or update technical documentation. Handles greenfield projects, refactoring non-compliant docs, and incremental updates after code changes.
Work on a multi-story GitHub epic end-to-end. Builds a DAG from the child stories, groups them into waves, runs waves in parallel via per-story worktrees, ejects PRs that fail agent-code-review for human handling, and propagates blocks to downstream stories. Requires git worktrees.
Initialise a project for use with Maverick — verifies the GitHub App, installs the CLI if needed, writes the project config with integration tracking, scaffolds docs, generates project skills, runs an initial cybersecurity audit, then commits the changes and opens a PR.