security-guardrails
Skill from ibrahimkobeissy/harneo
Install
npx skills add ibrahimkobeissy/harneo --skill security-guardrails
Runs the open skills CLI and installs the skill for your agent (Claude Code, Codex, Cursor …). Alternatively copy the skill folder into .claude/skills/ or upload it in Claude.ai under Settings → Skills.
What does the security-guardrails skill do?
Description from the SKILL.md in the source repository.
Questions about security-guardrails
What does the security-guardrails skill do?
Explains and maintains this project's security guardrails: the deny rules and the guard.py hook that stop agents from reading credentials and secrets, leaking tokens through gh, or destroying git work. Use when a command was blocked or asked for approval by security-guardrails, when the user asks why something is blocked or wants an exception, wants to review guard.log, run the self-test, or install the gitleaks pre-commit hook.
How do I install security-guardrails?
In a terminal: npx skills add ibrahimkobeissy/harneo --skill security-guardrails. The skills CLI asks which agents to install it for. In Claude.ai you can upload the skill folder as a ZIP under Settings → Skills.
Which agents can use security-guardrails?
Skills use the open SKILL.md format, which Claude Code, Claude.ai, the Claude API, OpenAI Codex, Cursor, Gemini CLI and other agents support.
Is security-guardrails safe to use?
Our automatic check found risky patterns (see “Check”). Only install it if you understand and trust what it does.
More skills from ibrahimkobeissy/harneo
Run a project's work from GitHub Issues and a GitHub Projects board, trunk-based on main. Every change gets a ticket. An orchestrator session picks up to MAX_AGENTS (default 3) Ready tickets, hands each to a Sonnet subagent in its own worktree off main, then validates, fixes, merges and pushes the work itself. The board Status (Backlog → Ready → In progress → In review → Done) is updated at each step. Use when the user asks what's on the backlog, to pick, start or run tickets, to create, update, triage or close a ticket, to move a ticket on the board, or to "run the cycle"; and before making any code change in a project that uses this skill.
Keep short working notes
Format the changed files
Review a change on five axes
Run the linter and fix what it reports
Write the failing test first, then the code
Related skills in Security
Rigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation command and write standardized `repro_outputs/` files, including patch notes when repository files changed. Do not use for training execution, initial repo intake, generic environment setup, paper lookup, target selection, hidden scientific-meaning changes, or end-to-end orchestration by itself.
When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost rankings," "not showing up in Google," "site isn't ranking," "Google update hit me," "page speed," "core web vitals," "crawl errors," "indexing issues," "stuck on page 2," "striking distance keywords," "title tag rewrite," "low CTR," "local SEO," "Google Business Profile," or "map pack." Use this even if the user just says something vague like "my SEO is bad" or "help with SEO" — start with an audit. For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema. For AI search optimization, see ai-seo.
Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/comprehensive/end-to-end reviews, or requested report artifacts.
When the user wants help with pricing decisions, packaging, or monetization strategy. Also use when the user mentions 'pricing,' 'pricing tiers,' 'freemium,' 'free trial,' 'packaging,' 'price increase,' 'value metric,' 'Van Westendorp,' 'willingness to pay,' 'monetization,' 'how much should I charge,' 'my pricing is wrong,' 'pricing page,' 'annual vs monthly,' 'per seat pricing,' 'should I offer a free plan,' 'pricing page teardown,' 'pricing page audit,' 'is my pricing page AI-readable,' or 'can AI read my pricing.' Use this whenever someone is figuring out what to charge, how to structure their plans, or wants to audit a pricing page (for humans and for the AI agents that shortlist tools). For in-app upgrade screens, see paywalls. For offer construction (bonuses, guarantees, value framing, naming) on services/courses/coaching/high-ticket B2B, see offers.
Authentication integration guidance — Clerk (native Vercel Marketplace), Better Auth, Descope, and Auth0 setup for Next.js applications, plus Sign in with Vercel, Vercel Passport, and Vercel KMS. Covers server config, route handlers, proxy.ts auth patterns, sign-in/sign-up flows, and Marketplace provisioning. Use when implementing user authentication, sessions, protected routes, or protecting deployments.
Vercel Firewall expert guidance — automatic DDoS mitigation, the Vercel WAF (custom rules, IP blocking, managed rulesets, rate limiting), Attack Mode, system bypass, bot management, and the `vercel firewall` CLI. Use when configuring platform-level security, responding to attacks, or staging firewall rules.
Read Snowflake from an AIDP notebook through the AIDP `aidataplatform` Spark format handler. Use when the user mentions Snowflake, Snowflake warehouse, Basic authentication, KeyPair authentication, private.key.file, or private.key.content. Snowflake writes are not supported in AIDP 4.0.
Show failing Vanta compliance tests, prioritized by what can be fixed from this repository