{
  "markdown": "# agentic-guardrails\n\nProduction-ready governance commands and engineering quality guardrails.\n\nInstalls four slash commands and an `engineering-standards` skill that enforce consistent type safety, security, observability, and accessibility practices across any project.\n\n---\n\n## Commands\n\n| Command | Scope | Purpose |\n|---|---|---|\n| `/cleanup` | Files changed in current branch vs `main` | Pre-PR hygiene pass |\n| `/sweep` | Entire working directory | Full technical debt audit |\n| `/security-scan` | Entire working directory | Security and vulnerability scan |\n| `/review` | All uncommitted changes | Expert review before staging |\n\n---\n\n## Installation\n\n### Prerequisites\n- [Claude Code](https://claude.ai/code) installed\n\n### Via the Claude Code Plugin Store *(coming soon)*\n\nOnce published, you'll be able to install directly from the official Claude Code plugin store — no manual steps required.\n\n### Manual install\n\nClone the repo:\n\n```bash\ngit clone https://github.com/l-filice89/agentic-guardrails.git ~/.claude/plugins/agentic-guardrails\n```\n\nClaude Code does not support permanently enabling local (non-marketplace) plugins via settings. Use one of the following approaches:\n\n**Option A — Shell alias (recommended)**\n\nAdd to your `~/.zshrc` (or `~/.bashrc`):\n\n```bash\nalias claude='claude --plugin-dir ~/.claude/plugins/agentic-guardrails'\n```\n\nReload your shell (`source ~/.zshrc`). Commands will be available in every Claude Code session, namespaced as `/agentic-guardrails:cleanup`, `/agentic-guardrails:sweep`, etc.\n\n**Option B — Per-session flag**\n\n```bash\nclaude --plugin-dir ~/.claude/plugins/agentic-guardrails\n```\n\nUse this for one-off sessions without modifying your shell config.\n\n**Option C — Standalone commands (no namespace)**\n\nCopy the command files into your user-level Claude commands directory:\n\n```bash\ncp ~/.claude/plugins/agentic-guardrails/commands/*.md ~/.claude/commands/\n```\n\nCommands will load automatically as `/cleanup`, `/sweep`, etc. — no flag or namespace needed. You lose the plugin packaging but gain the shorter names.\n\n---\n\n## Commands in Detail\n\n### `/cleanup`\nTargeted cleanup on files changed in the current branch relative to `main`. Run this before opening a PR.\n\nChecks: dead code, DRY violations, type safety anti-patterns, framework health, test coverage gaps, logging hygiene, leftover AI artifacts.\n\n### `/sweep`\nSame checks as `/cleanup` but across the entire working directory. Use this for periodic debt audits or when onboarding to an unfamiliar codebase.\n\n### `/security-scan`\nScans for:\n- Hardcoded secrets and API keys\n- Authentication/authorization flaws and missing RBAC\n- Injection vectors (SQL, XSS, unsafe deserialization)\n- Tenant boundary violations and IDOR risks\n- Suspicious or unverified third-party dependencies\n\nOutputs findings with severity: **Critical / High / Medium / Low**.\n\n### `/review`\nReviews all uncommitted changes — staged edits, unstaged edits, and untracked new files — as an expert senior engineer. Outputs findings with file name, line number, problem, and suggested fix.\n\n---\n\n## Skill: `engineering-standards`\n\nThe `engineering-standards` skill is loaded automatically when you write or review backend or frontend code. It enforces:\n\n- **Strict type safety** — no `any`, blind casting, or type-checker bypass directives\n- **Structured logging** — JSON-based logger with correlation IDs; no raw `console.log`/`print` in backend code\n- **Tenant isolation** — IDOR prevention; server-side validation of all IDs; never trust client-provided tenant context\n- **Mobile-first UI** — semantic HTML, `aria-labels`, keyboard navigation, no hardcoded desktop widths\n- **Testing discipline** — backend TDD before business logic; pragmatic client-side testing focused on state and data\n- **ADRs** — for significant architectural decisions (new dependencies, schema changes, cross-service contracts)\n- **Definition of Done** — type check, lint, clean state, build, and manual test steps before declaring work complete\n\n### Injecting your own standards\n\nThe skill in `skills/SKILL.md` contains the universal engineering standards that apply to any project. If you maintain personal coding preferences in a `~/.claude/CLAUDE.md` file, the recommended split is:\n\n- **CLAUDE.md** — personal workflow preferences (e.g., git habits, tone, explanation depth)\n- **SKILL.md** — universal, shareable engineering standards (type safety, logging, security, testing)\n\nTo customize this plugin for your team, fork the repo and edit `skills/SKILL.md` directly.\n\n---\n\n## Testing\n\nFixtures with deliberate violations are provided in `tests/fixtures/`. Each file is annotated with the violations it contains.\n\nTo spin up an isolated test workspace:\n\n```bash\nbash tests/setup.sh\n```\n\nThis creates a temporary git repo pre-loaded with the fixtures and prints the commands to run. Compare the output against `tests/EXPECTED.md`.\n\n---\n\n## License\n\nMIT\n",
  "bytes": 4915,
  "sha": "ee44216910d940596fbbf1c0c1a2178ecd67f04e7a9ee56362964b3358be7fae",
  "repo_slug": "l-filice89/agentic-guardrails",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_l_filice89_agentic_guardrails_agentic_gu_8a9bf0a4/readme"
}