Intelligent Gate Decision Framework
When This Skill Activates
This skill provides the decision-making methodology when the PreToolUse hook detects potentially risky operations:
- Destructive commands (rm, delete, reset)
- System modifications (chmod, chown, sudo)
- Sensitive file access (.env, credentials, secrets)
- Configuration changes (package.json, requirements.txt)
Decision Framework
TRIGGER: Risky operation detected by hook
↓
AUDIT: What exactly is being attempted?
↓
ASSESS: What is the risk level? (low/medium/high/critical)
↓
RESEARCH: Check context, constraints, past decisions
↓
THINK: Apply escalation reasoning if needed
↓
DECIDE: Allow / Modify / Escalate / Deny
↓
ACT: Execute with full reasoning logged
Risk Categories
| Level |
Examples |
Action |
| LOW |
Read, ls, pwd, grep |
Allow silently |
| MEDIUM |
Write to project files |
Log and allow |
| HIGH |
rm -r, chmod, git reset |
Audit + Think + Decide |
| CRITICAL |
rm -rf /, sudo, .env |
Multi-model consultation |
Audit Questions
When AUDIT phase triggers, ask:
- What is the exact operation being attempted?
- Why is this operation being requested?
- Where will this operation have effect?
- What are the potential consequences?
- Is there a safer alternative?
Assessment Criteria
HIGH Risk Indicators
- Recursive deletion (
rm -rf, rm -r)
- Force flags (
-f, --force)
- System paths (
/etc, /usr, /bin)
- Root operations (
sudo, su)
- Credential files (
.env, secrets, credentials)
CRITICAL Risk Indicators
- Root filesystem operations (
rm -rf /)
- Disk formatting (
mkfs, dd)
- Security bypasses (
chmod 777, --no-verify)
- Piping untrusted content to shell (
curl | sh)
Escalation Integration
When risk is HIGH or CRITICAL:
- First: Use
/think to reason through implications
- If uncertain: Use
/megathink for deeper analysis
- For CRITICAL: Use
/ultrathink or consult-llm
- Always: Log decision with full reasoning
Output Format
The intelligent gate returns structured decisions:
{
"decision": "allow|modify|escalate|deny",
"risk_level": "low|medium|high|critical",
"reasoning": "Full explanation of decision process",
"audit_trail": "What was checked and found",
"alternative": "Safer alternative if available"
}
Integration with Hooks
This skill provides the methodology that the intelligent_gate.py hook implements. The hook:
- Detects risky patterns
- Assesses risk level
- Makes decision based on this framework
- Logs to
~/.claude/logs/decision-audit.jsonl
- Returns decision to Claude
Best Practices
- Never block silently - Always provide reasoning
- Suggest alternatives - Don't just deny, help find safer paths
- Log everything - Audit trail enables learning
- Escalate appropriately - Use thinking levels for uncertainty
- Trust but verify - Most operations are safe, focus on exceptions
1---2name: intelligent-gate3description: Decision-making framework for risky operations. Activates when PreToolUse hook triggers on potentially dangerous commands. Provides methodology for AUDIT → ASSESS → RESEARCH → THINK → DECIDE → ACT workflow.4---56# Intelligent Gate Decision Framework78## When This Skill Activates910This skill provides the decision-making methodology when the PreToolUse hook detects potentially risky operations:11- Destructive commands (rm, delete, reset)12- System modifications (chmod, chown, sudo)13- Sensitive file access (.env, credentials, secrets)14- Configuration changes (package.json, requirements.txt)1516## Decision Framework1718```19TRIGGER: Risky operation detected by hook20 ↓21AUDIT: What exactly is being attempted?22 ↓23ASSESS: What is the risk level? (low/medium/high/critical)24 ↓25RESEARCH: Check context, constraints, past decisions26 ↓27THINK: Apply escalation reasoning if needed28 ↓29DECIDE: Allow / Modify / Escalate / Deny30 ↓31ACT: Execute with full reasoning logged32```3334## Risk Categories3536| Level | Examples | Action |37|-------|----------|--------|38| LOW | Read, ls, pwd, grep | Allow silently |39| MEDIUM | Write to project files | Log and allow |40| HIGH | rm -r, chmod, git reset | Audit + Think + Decide |41| CRITICAL | rm -rf /, sudo, .env | Multi-model consultation |4243## Audit Questions4445When AUDIT phase triggers, ask:461. **What** is the exact operation being attempted?472. **Why** is this operation being requested?483. **Where** will this operation have effect?494. **What** are the potential consequences?505. **Is there** a safer alternative?5152## Assessment Criteria5354### HIGH Risk Indicators55- Recursive deletion (`rm -rf`, `rm -r`)56- Force flags (`-f`, `--force`)57- System paths (`/etc`, `/usr`, `/bin`)58- Root operations (`sudo`, `su`)59- Credential files (`.env`, `secrets`, `credentials`)6061### CRITICAL Risk Indicators62- Root filesystem operations (`rm -rf /`)63- Disk formatting (`mkfs`, `dd`)64- Security bypasses (`chmod 777`, `--no-verify`)65- Piping untrusted content to shell (`curl | sh`)6667## Escalation Integration6869When risk is HIGH or CRITICAL:701. **First**: Use `/think` to reason through implications712. **If uncertain**: Use `/megathink` for deeper analysis723. **For CRITICAL**: Use `/ultrathink` or `consult-llm`734. **Always**: Log decision with full reasoning7475## Output Format7677The intelligent gate returns structured decisions:7879```json80{81 "decision": "allow|modify|escalate|deny",82 "risk_level": "low|medium|high|critical",83 "reasoning": "Full explanation of decision process",84 "audit_trail": "What was checked and found",85 "alternative": "Safer alternative if available"86}87```8889## Integration with Hooks9091This skill provides the methodology that the `intelligent_gate.py` hook implements. The hook:921. Detects risky patterns932. Assesses risk level943. Makes decision based on this framework954. Logs to `~/.claude/logs/decision-audit.jsonl`965. Returns decision to Claude9798## Best Practices991001. **Never block silently** - Always provide reasoning1012. **Suggest alternatives** - Don't just deny, help find safer paths1023. **Log everything** - Audit trail enables learning1034. **Escalate appropriately** - Use thinking levels for uncertainty1045. **Trust but verify** - Most operations are safe, focus on exceptions
I-Onlabs