Guard Skills: Guard Skills for AI Coding Agents
Second-pass quality gates that catch AI-generated failure modes in code, tests, and docs before they ship.
Evidence shows: README explicitly states no executable scripts, no network calls, no MCP dependencies, no credentials; skill content is Markdown and lightweight metadata; installation requires user-initiated commands; updates require manual trigger; external URLs centralized in references/sources.md; MIT license. Deductions: no detailed permission inventory or data flow diagram; user confirmation mechanism not detailed; dependency security lacks specific audit info; rollback only mentions update commands; source attribution relies solely on repository metadata.
Evidence shows: README describes each skill's purpose and trigger, structure is consistent, dependencies are Skills CLI and external references, failure messages not detailed but skills designed as review feedback. Deductions: no specific examples of failure messages or error handling strategies; dependency availability unverified.
Evidence shows: clear target audience of coding agents, scenarios include code, tests, docs, WordPress, WooCommerce; capability boundaries clear; trigger methods explicit; supports multiple agents and environments. Deductions: no environment compatibility matrix or detailed configuration instructions.
Evidence shows: README provides install, update, usage instructions; skill naming clear; examples provided; MIT license; maintenance responsibility clear. Deductions: no version number or changelog; known limitations not explicitly listed.
Evidence shows: output is review feedback, directly usable for improvement; value in catching AI failure modes; low cost (no execution dependencies). Deductions: no actual effectiveness data or user feedback.
Evidence shows: README references research, external URLs in sources.md, facts and inferences separated. Deductions: no specific research citations or verification methods; cross-source corroboration insufficient.
- Static review; no skills executed; actual effectiveness unverified.
- Relies on Skills CLI; ensure its security and availability.
- External reference URLs unverified; may be stale or misleading.
- No versioning; updates may introduce breaking changes.
What does this agent do, and when should you use it?
Guard Skills is a collection of focused guard skills for coding agents, acting as second-pass quality gates to catch systematic failure modes in AI-generated code, tests, and docs before delivery. It includes five skills: clean-code-guard (code quality gate for any language), test-guard (test code quality gate), docs-guard (documentation accuracy gate), wp-guard (WordPress-specific gate), and woo-guard (WooCommerce-specific gate). Each skill is structured with a lightweight SKILL.md entrypoint and progressive-disclosure references, with metadata supporting agents like Claude Code, Codex, Cursor, and OpenCode. Installation and updates are managed via the Skills CLI from Vercel Labs, supporting single-skill or global installation. The skills are best used as reactive review passes after an agent produces work, but can also guide writing when explicitly requested. The project is MIT-licensed, designed to be inspectable, containing only Markdown and YAML metadata with no executable scripts or credentials.
Guard Skills are distributed via the Skills CLI (npx skills add amElnagdy/guard-skills) and include five skills: clean-code-guard applies Clean Code, SOLID, DRY/KISS/YAGNI principles plus an AI-specific layer (catch-all error swallowing, hardcoded success returns, hallucinated APIs, premature abstraction, comment pollution, copy-from-similar bugs); test-guard enforces nine universal rules (e.g., mock only at system boundaries, parametrize instead of copy-pasting) with framework-specific progressive-disclosure references for pytest, PHPUnit/Pest, Jest/Vitest, Go tests, etc.; docs-guard treats documentation as a list of claims and verifies each against the codebase to catch hallucinated symbols and broken samples; wp-guard enforces WordPress practices (escaping, sanitization, nonces, capabilities, prepared queries, i18n, query/caching discipline); woo-guard enforces WooCommerce-specific rules (HPOS-safe order access, CRUD over direct meta, truthful feature-compatibility declarations, server-side checkout validation, money-handling discipline). Each skill is loaded via a SKILL.md entrypoint with deeper guidance loaded on demand.
- A developer asks their coding agent to review a diff with
$clean-code-guardafter producing production code, to catch over-abstraction and error-swallowing before merge. - After writing tests, a developer uses
$test-guardto check for mock abuse, duplicate tests, and assertions that don't catch anything. - Before shipping a README update, a developer runs
$docs-guardto verify all referenced symbols and examples are real and runnable. - A WordPress developer uses
$wp-guardto enforce escaping, nonce checks, and prepared queries in plugin changes. - A WooCommerce developer uses
$woo-guardto ensure HPOS compatibility and proper money handling in checkout customizations.
What are this agent's strengths and limitations?
- Specifically targets AI-generated code failure modes (error swallowing, hallucinated APIs) unlike generic linters.
- Uses progressive disclosure: lightweight SKILL.md loads cheaply, deeper guidance only when needed.
- Covers niche domains like WordPress and WooCommerce with platform-specific security and correctness rules.
- Inspectable: no scripts, credentials, or network calls, making it safe to audit.
- Requires Skills CLI and network access for installation, which may be a dependency.
- Skills are copied locally, so updates need manual re-installation; otherwise they may become stale.
- Limited to review gates, not a full development workflow, so it won't cover whole process.
- No guarantee that all best practices are covered; each skill is a guide, not a formal checker.
How do you install or deploy this agent?
- List available skills:
npx skills add amElnagdy/guard-skills --list. - Install the package:
npx skills add amElnagdy/guard-skills. - Install a single skill, e.g.,
npx skills add amElnagdy/guard-skills --skill clean-code-guard. - Install for a specific agent, e.g.,
npx skills add amElnagdy/guard-skills --skill test-guard --agent claude-code. - Install globally:
npx skills add amElnagdy/guard-skills --global. - Update skills:
npx skills updateor re-run the add command.
How do you use this agent?
Run a guard after your agent produces work: Use $clean-code-guard on the diff you just produced. Use $test-guard on the tests you just wrote. Use $docs-guard on the README update before shipping. Use $wp-guard on WordPress plugin changes. Use $woo-guard on WooCommerce checkout changes. You can also use a guard up front: 'Use $wp-guard while implementing this REST endpoint, then self-check before delivery.'
How does this agent compare with similar options?
Compared to WordPress/agent-skills which teach agents to build across the WordPress ecosystem, Guard Skills is narrower: it provides review gates to run after work is produced, focusing on catching common AI failure modes rather than building abilities.
FAQ
Is there a cost to use these skills?
How do I update the skills after installing?
npx skills update or re-run the install command to re-fetch the latest version.