agent-safety-guard-plus

Built on affaan-m/ECC by @affaan-m (261,682 stars, MIT). All credit for the original idea to them. This fork improves and repackages it; upstream license preserved in UPSTREAM_LICENSE.

A Claude Code skill that stops risky commands and keeps file changes inside the folder you choose.

Built for developers who use Claude Code on live apps, data, deploys, or tasks that run on their own.

🛡️ Why

One wrong command can remove files, erase Git work, or change live data.

An agent may also edit files outside the task folder by mistake.

Safety Guard checks commands and file paths before tools run. It can warn, block, or ask for clear approval. It works with your current Claude Code flow.

⚡ Install

Run this one command:

mkdir -p ~/.claude/skills/safety-guard && curl -fsSL https://raw.githubusercontent.com/agent-safety-guard-plus/agent-safety-guard-plus/main/skill/SKILL.md -o ~/.claude/skills/safety-guard/SKILL.md

The skill is one file and needs no extra package.

🚦 Usage

Turn on Guard mode before Claude starts work:

/safety-guard guard --dir src/api/ --allow-read-all

Claude may read all files. It may only change files inside src/api/. It will also check for risky commands in every folder.

For example, if a task tries to run:

git reset --hard

Expected output:

Blocked by Safety Guard.

Action: git reset --hard
Risk: This can erase work that is not saved in Git.
Safer choice: Use git status and git diff first.
Run it only if the user gives clear approval.

You can also use Careful mode by itself:

/safety-guard careful

Or limit file changes with Freeze mode:

/safety-guard freeze src/components/

Turning the guard off needs clear user approval:

/safety-guard off

🔧 What we changed vs upstream

• Rewrote the skill from Japanese to English. Added clear credit to ECC and simpler, more direct help.
• Added checks for git push -f, git clean -fd, TRUNCATE TABLE, and other risky commands. Checks also cover commands hidden in scripts, pipes, groups, loops, aliases, and variables.
• Made Freeze mode stricter. It now says to resolve full paths and links first. It also blocks writes outside the set folder from shell commands, moves, copies, code tools, format tools, and build tools.
• Added clear steps for risky actions and for turning the guard off. Added allowed and blocked examples plus a standard block reply.
• Added strict rules for empty paths, root paths, wildcards, secrets, side effects, and targets that cannot be proved safe.

📄 License

This project uses the MIT License. See LICENSE.

The upstream MIT license and credit are preserved in UPSTREAM_LICENSE.