jz-agent-guardrails_skill

Overview

This skill provides mechanical enforcement to stop AI agents from secretly bypassing your project rules. It installs git hooks, secret scanners, deployment verification scripts, and import registries so rules become enforced code, not optional guidelines. Born from real production incidents, it integrates into projects once and continues to block bypass patterns automatically.

How this skill works

Install a small set of scripts and git hooks into your repository; those hooks run pre-create, post-create, and pre-commit checks that detect reimplementations, hardcoded secrets, and deployment gaps. Registry templates and import enforcement reduce accidental rework by encouraging reuse. Optional feedback loops detect when enforcement improvements themselves need to be propagated and can auto-commit or flag follow-up tasks.

When to use it

• When agents or automated processes repeatedly create duplicate or rewritten code instead of importing shared modules.
• When preventing hardcoded tokens, keys, or passwords from entering commits is critical.
• When you need mechanical checks to verify end-to-end deployment wiring before marking work as done.
• When you want a reproducible, project-level enforcement layer that does not rely solely on prompts or documentation.
• When you need to propagate enforcement improvements across multiple projects or skills.

Best practices

• Run install.sh once per project to scaffold hooks, registry templates, and check scripts.
• Invoke pre-create checks before adding new .py files to detect existing functionality to import.
• Enforce post-create validation and fix warnings before committing; treat hook failures as blocking.
• Customize .deployment-check.sh with integration tests for your actual production paths.
• Enable the skill update feedback loop to catch and propagate meta-level enforcement improvements.

Example use cases

• Blocking an agent from committing a new implementation of an existing notify function by forcing an import.
• Detecting and rejecting a commit that contains a hardcoded API key discovered by check-secrets.sh.
• Preventing deployment gaps by running automated end-to-end checks before allowing a release commit.
• Automatically flagging and creating a task when enforcement scripts are changed but not propagated to other projects.
• Installing registry-template.py so agents prefer importing validated modules rather than reimplementing logic.