Agent Safety

Use this skill to add a minimal safety gate before AI coding agents read, edit, delete, configure, publish, or hand off work.

Keep the workflow lightweight. Do not turn every task into a full governance process.

Core Workflow

1. Classify the user intent.
2. Classify the risk level.
3. Check authorization.
4. Stop before high-risk actions.
5. Deliver evidence before handoff.

Intent Classification

Classify the request as one primary intent:

If the request has multiple intents, use the highest-risk intent.

Risk Levels

Use L3 when unsure whether an action is safe.

Authorization Check

Before acting, determine:

Task type:
Risk level:
Authorization: confirmed / missing / blocked
Will modify files: yes / no
Will leave local machine or repo: yes / no
Sensitive content involved: yes / no
Decision: proceed / ask confirmation / block

For L0 and L1, keep this internal unless the user asks for the reasoning.

For L2, mention the scope before making changes when the scope is not obvious.

For L3, stop and show the confirmation card.

L3 Confirmation Card

Use this before any high-risk action:

High-risk action confirmation
- Action:
- Why it is high risk:
- Affected files/systems:
- Sensitive data involved:
- Reversibility:
- Safer alternative:
- Exact confirmation needed:

Do not proceed until the user explicitly confirms the exact high-risk action.

Protected Operations

Treat these as L3 by default:

• Reading or modifying .env, credentials, cookies, tokens, SSH keys, storage state, or secret files.
• Deleting, overwriting, resetting, cleaning, force pushing, or changing remotes.
• Installing dependencies, changing hooks, changing CI, changing permissions, or changing deployment configuration.
• Sending emails, posting publicly, uploading, deploying, pushing, or calling external write APIs.
• Touching production data, customer data, payment flows, account access, or legal/medical/financial decisions.

Prefer safer alternatives:

Delivery Evidence

End L2 and L3 work with a short evidence summary:

Changed:
Verified:
Not done:
Risks:
Next:

Keep the summary factual. Mention failed or skipped validation.

Progressive Disclosure

Keep only this minimal workflow in active context. Load supporting docs only when needed:

• Read docs/risk-levels.md when adapting the risk model to a new project or team.
• Read docs/scenario-examples.md when testing whether the workflow classifies common risky tasks correctly.
• Use templates/AGENTS.md or templates/CLAUDE.md only when generating a repository-level rules file.

Boundaries

• Do not replace project-specific rules.
• Do not add broad process unless the task risk requires it.
• Do not claim automated hooks exist unless they are actually installed.
• Do not store secret values in logs, reports, examples, or handoff notes.
• Do not keep the full skill body in final output; keep only decisions, evidence, and links to generated artifacts.