🛡️Guardrails and Safety Skills
Browse the best Guardrails and Safety skills for Claude Code, Codex, Cursor and other AI agents.
352 skills · Page 1 of 15
verification-before-completion
★ 19Loaded by ALL agents before completion claims in cc10x-router workflows. DO NOT invoke directly - loaded automatically via agent frontmatter.Requires running verification commands and confirming output with evidence before any success claims. Iron Law: EVIDENCE BEFORE CLAIMS.Agents are invoked through cc10x-router workflows (BUILD/REVIEW/DEBUG/PLAN) - do not invoke agents or this skill directly.
damage-control-expert
★ 1The Damage Control Expert - Guardian of the Nebuchadnezzar v4.0 system integrity.Monitors PreToolUse hooks, manages blocked operation alerts, and coordinates incident response.This expert protects critical files, prevents destructive commands, and maintains system safety.Use when:(1) Blocked operation detected - HUD shows active damage alerts(2) "damage control" or "security" - review blocked operations history(3) "unblock" or "whitelist" - analyze if operation should be allowed(4) Hook configuration - modify patterns.yaml protections(5) Incident response - coordinate recovery from blocked operationsTriggers on: "damage control", "blocked operation", "security alert", "damage detected", "unblock", "whitelist", "hook configuration", "protected path"
verification-protocol
★ 1Independent verification of task completion - eliminates self-attestation
security-validation
Runtime security validation including secret scanning, PII detection, prompt injection defense, audit logging, and output validation for AI agents. Use when validating user input, scanning for secrets, detecting PII, preventing data exfiltration, or implementing security guardrails.
damage-control
★ 9Install, configure, and manage the Claude Code Damage Control security hooks system. Use when user mentions damage control, security hooks, protected paths, blocked commands, install security, or modify protection settings.
never-guess
★ 2Behavioral principle ensuring Claude never guesses when uncertain. Use when Claude's response involves facts it cannot verify, technical claims, or any statement where accuracy matters. Complements resolve-ambiguity skill.
input-validation-xss-prevention
★ 1Validate and sanitize user input to prevent XSS, injection attacks, and ensure data quality. Use this skill when you need to validate forms, sanitize user input, prevent cross-site scripting, use Zod schemas, or handle any user-generated content. Triggers include "input validation", "validate input", "XSS", "cross-site scripting", "sanitize", "Zod", "injection prevention", "validateRequest", "safeTextSchema", "user input security".
smith-guidance
Core agent steering with HHH framework (Helpful, Honest, Harmless), exploration-before-implementation workflow, and anti-sycophancy rules. Use when guiding AI agent behavior, handling disagreements, or establishing interaction patterns. Always active for all agent interactions.
core
Core development principles and guidelines covering security, QA, performance, documentation, and coding standards. Used by all agents to ensure consistent quality across the Orchestra system.
hashing-passwords
CRITICAL security skill teaching proper credential and password handling. NEVER store passwords, use bcrypt/argon2, NEVER accept third-party credentials. Use when handling authentication, passwords, API keys, or any sensitive credentials.
supabase-database-ops
Critical guardrail for Supabase database operations ensuring multi-tenant isolation with publication_id filtering, proper use of supabaseAdmin, avoiding SELECT *, error handling patterns, and secure server-side database access. Use when writing database queries, working with supabase, accessing newsletter_campaigns, articles, rss_posts, or any tenant-scoped data.
nemo-guardrails
★ 15.4kNVIDIA's runtime safety framework for LLM applications. Features jailbreak detection, input/output validation, fact-checking, hallucination detection, PII filtering, toxicity detection. Uses Colang 2.0 DSL for programmable rails. Production-ready, runs on T4 GPU.
llamaguard
★ 15.4kMeta's 7-8B specialized moderation model for LLM input/output filtering. 6 safety categories - violence/hate, sexual content, weapons, substances, self-harm, criminal planning. 94-95% accuracy. Deploy with vLLM, HuggingFace, Sagemaker. Integrates with NeMo Guardrails.
guidance
★ 481Control LLM output with regex and grammars, guarantee valid JSON/XML/code generation, enforce structured formats, and build multi-step workflows with Guidance - Microsoft Research's constrained generation framework
devflow-tdd-enforcer
★ 93Enforces TDD order in TASKS.md - Tests MUST be marked complete before Implementation tasks. Blocks violations in real-time.
api-security
★ 30API security best practices and common vulnerability prevention. Enforces security checks for authentication, input validation, SQL injection, XSS, and OWASP Top 10 vulnerabilities. Use when building or modifying APIs.
hallucination-detector
★ 16Detect and prevent hallucinated technical decisions during feature work. Auto-trigger when suggesting technologies, frameworks, APIs, database schemas, or external services. Validates all tech decisions against docs/project/tech-stack.md (single source of truth). Blocks suggestions that violate documented architecture. Requires evidence/citation for all technical choices. Prevents wrong tech stack, duplicate entities, fake APIs, incompatible versions.
rule-identifier
★ 10This skill should be used when the user asks to "create a hookify rule", "write a hook rule", "configure hookify", "add a hookify rule", or needs guidance on hookify rule syntax and patterns.
validation-standards
★ 8Tool usage requirements, failure patterns, consistency checks, and validation methodologies for Claude Code operations
sme-agent-protocol
★ 6Mandatory protocol for all SME (Subject Matter Expert) agents. Defines fact-finding requirements, output contracts, confidence/risk assessment, and qualification of advice.
global-validation
★ 6Implement secure, comprehensive input validation on both client and server sides using allowlists, type checking, and sanitization to prevent injection attacks. Use this skill when handling user input from forms, API requests, or any external data source. When implementing form validation logic with field-specific error messages. When validating data types, formats, ranges, and required fields. When sanitizing input to prevent SQL injection, XSS, or command injection. When validating business rules like sufficient balance or valid date ranges. When implementing both client-side validation for user experience and mandatory server-side validation for security.
why-driven-decision
★ 5FOUNDATIONAL SKILL - Analyze every prompt for underlying motivation using Golden Circle (WHY->HOW->WHAT). Runs BEFORE any other skill. No action without understanding WHY.
skill-security-analyzer
★ 5Comprehensive security risk analysis for Claude skills. Use when asked to analyze security risks, review security stance, audit skills for vulnerabilities, check security before deployment, or evaluate safety of skill files. Triggers include "analyze security," "security risks," "security audit," "security review," "is this skill safe," or "check for vulnerabilities."
external-system-safety
★ 5Enforces confirmation workflow for EXTERNAL system writes (Jira, Confluence, BitBucket, Slack) ONLY. NEVER activates for Linear operations (Linear is internal tracking). Auto-activates when detecting potential writes to external PM systems (status updates, page creation, PR posts, notifications). Blocks execution and displays exact content that will be written. Requires explicit "yes" confirmation (rejects "ok", "sure", ambiguous responses). All Linear operations execute automatically without confirmation. Works alongside ccpm-code-review to ensure quality before external broadcasts. Provides audit trail of all confirmed operations. Allows batch operations with granular per-item confirmation when needed.