code-guard
Safety net after code changes. Fast (checks only changed files), silent when
clean, compact report when not.
Script: scripts/code_guard.py
Workflow
After any code edit, before declaring the task done:
python3 scripts/code_guard.py --root <repo> # checks git-changed files
python3 scripts/code_guard.py --root <repo> FILE... # or specific files
python3 scripts/code_guard.py --root <repo> --run-tests # also run impacted pytest tests
Exit 0 + "clean" → proceed. Exit 1 → fix CRIT findings before finishing;
use judgment on WARN (fix or explain to the user); INFO is advisory.
What it checks
- Secrets (CRIT): AWS/GitHub/OpenAI/Slack/Google/Stripe/Telegram keys,
JWTs, private key blocks, hardcoded passwords, credentials in URLs.
Placeholders (example/changeme/os.environ/...) are ignored.
- Env hygiene (CRIT):
.env present but not gitignored; .env tracked by git.
- Syntax errors (CRIT): py_compile / node --check.
- Bug patterns (WARN): bare except, swallowed exceptions, mutable default
args,
== None, eval, shell=True, SQL string interpolation, verify=False,
innerHTML/dangerouslySetInnerHTML, empty catch, leftover debugger/breakpoint.
- Linters if installed (WARN): ruff, mypy, eslint — auto-skipped if absent.
- Impacted tests (INFO/CRIT): via
.claude/index/ from the project-index
skill — which test files transitively depend on changed files; with
--run-tests runs them (CRIT if failing).
Automatic mode in Claude Code (hook)
Add to <repo>/.claude/settings.json (or ~/.claude/settings.json for all
projects) — the check then runs by itself after every Edit/Write; findings are
fed back to Claude via exit code 2:
{
"hooks": {
"PostToolUse": [
{
"matcher": "Edit|Write",
"hooks": [
{
"type": "command",
"command": "python3 ~/.claude/skills/code-guard/scripts/code_guard.py --hook"
}
]
}
]
}
}
Honest limits
Regex-based checks catch common cases, not everything: no taint analysis, no
cross-file dataflow. For a deep pass before merging, additionally run Claude
Code's built-in /security-review. code-guard is the always-on cheap layer,
not a replacement for review.
1---2name: code-guard3description: Post-write code safety check. Run AFTER writing or editing code files (.py, .js, .ts, etc.) and BEFORE telling the user the work is done or committing. Detects leaked secrets (API keys, passwords, tokens, .env hygiene), common bug patterns (bare except, mutable defaults, eval, SQL injection, XSS, empty catch, leftover debuggers), syntax errors, lint/type issues (ruff/mypy/eslint if installed), and lists tests impacted by the change via project-index. Do NOT use for non-code files or when no code was modified.4---56# code-guard78Safety net after code changes. Fast (checks only changed files), silent when9clean, compact report when not.1011Script: `scripts/code_guard.py`1213## Workflow1415**After any code edit, before declaring the task done:**1617```18python3 scripts/code_guard.py --root <repo> # checks git-changed files19python3 scripts/code_guard.py --root <repo> FILE... # or specific files20python3 scripts/code_guard.py --root <repo> --run-tests # also run impacted pytest tests21```2223Exit 0 + "clean" → proceed. Exit 1 → **fix CRIT findings before finishing**;24use judgment on WARN (fix or explain to the user); INFO is advisory.2526## What it checks27281. **Secrets (CRIT):** AWS/GitHub/OpenAI/Slack/Google/Stripe/Telegram keys,29 JWTs, private key blocks, hardcoded passwords, credentials in URLs.30 Placeholders (example/changeme/os.environ/...) are ignored.312. **Env hygiene (CRIT):** `.env` present but not gitignored; `.env` tracked by git.323. **Syntax errors (CRIT):** py_compile / node --check.334. **Bug patterns (WARN):** bare except, swallowed exceptions, mutable default34 args, `== None`, eval, shell=True, SQL string interpolation, verify=False,35 innerHTML/dangerouslySetInnerHTML, empty catch, leftover debugger/breakpoint.365. **Linters if installed (WARN):** ruff, mypy, eslint — auto-skipped if absent.376. **Impacted tests (INFO/CRIT):** via `.claude/index/` from the project-index38 skill — which test files transitively depend on changed files; with39 `--run-tests` runs them (CRIT if failing).4041## Automatic mode in Claude Code (hook)4243Add to `<repo>/.claude/settings.json` (or `~/.claude/settings.json` for all44projects) — the check then runs by itself after every Edit/Write; findings are45fed back to Claude via exit code 2:4647```json48{49 "hooks": {50 "PostToolUse": [51 {52 "matcher": "Edit|Write",53 "hooks": [54 {55 "type": "command",56 "command": "python3 ~/.claude/skills/code-guard/scripts/code_guard.py --hook"57 }58 ]59 }60 ]61 }62}63```6465## Honest limits6667Regex-based checks catch common cases, not everything: no taint analysis, no68cross-file dataflow. For a deep pass before merging, additionally run Claude69Code's built-in `/security-review`. code-guard is the always-on cheap layer,70not a replacement for review.
iskendernarynbaev-lab