# Code Guard

> Post-write code safety check. Run AFTER writing or editing code files (.py, .js, .ts, etc.) and BEFORE telling the user the work is done or committing. Detects leaked secrets (API keys, passwords, tokens, .env hygiene), common bug patterns (bare except, mutable defaults, eval, SQL injection, XSS, empty catch, leftover debuggers), syntax errors, lint/type issues (ruff/mypy/eslint if installed), and lists tests impacted by the change via project-index. Do NOT use for non-code files or when no code was modified.

- Skill: `iskendernarynbaev-lab/code-guard` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add iskendernarynbaev-lab/code-guard`
- Raw SKILL.md: https://api.skillmd.com/api/skills/iskendernarynbaev-lab/code-guard/raw
- Safety review: pending (external: skill-scanner PASS, skillspector WARNING)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Data & Analytics
- Author: iskendernarynbaev-lab (https://skillmd.com/u/iskendernarynbaev-lab)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/iskendernarynbaev-lab/code-guard

---


# code-guard

Safety net after code changes. Fast (checks only changed files), silent when
clean, compact report when not.

Script: `scripts/code_guard.py`

## Workflow

**After any code edit, before declaring the task done:**

```
python3 scripts/code_guard.py --root <repo>              # checks git-changed files
python3 scripts/code_guard.py --root <repo> FILE...      # or specific files
python3 scripts/code_guard.py --root <repo> --run-tests  # also run impacted pytest tests
```

Exit 0 + "clean" → proceed. Exit 1 → **fix CRIT findings before finishing**;
use judgment on WARN (fix or explain to the user); INFO is advisory.

## What it checks

1. **Secrets (CRIT):** AWS/GitHub/OpenAI/Slack/Google/Stripe/Telegram keys,
   JWTs, private key blocks, hardcoded passwords, credentials in URLs.
   Placeholders (example/changeme/os.environ/...) are ignored.
2. **Env hygiene (CRIT):** `.env` present but not gitignored; `.env` tracked by git.
3. **Syntax errors (CRIT):** py_compile / node --check.
4. **Bug patterns (WARN):** bare except, swallowed exceptions, mutable default
   args, `== None`, eval, shell=True, SQL string interpolation, verify=False,
   innerHTML/dangerouslySetInnerHTML, empty catch, leftover debugger/breakpoint.
5. **Linters if installed (WARN):** ruff, mypy, eslint — auto-skipped if absent.
6. **Impacted tests (INFO/CRIT):** via `.claude/index/` from the project-index
   skill — which test files transitively depend on changed files; with
   `--run-tests` runs them (CRIT if failing).

## Automatic mode in Claude Code (hook)

Add to `<repo>/.claude/settings.json` (or `~/.claude/settings.json` for all
projects) — the check then runs by itself after every Edit/Write; findings are
fed back to Claude via exit code 2:

```json
{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Edit|Write",
        "hooks": [
          {
            "type": "command",
            "command": "python3 ~/.claude/skills/code-guard/scripts/code_guard.py --hook"
          }
        ]
      }
    ]
  }
}
```

## Honest limits

Regex-based checks catch common cases, not everything: no taint analysis, no
cross-file dataflow. For a deep pass before merging, additionally run Claude
Code's built-in `/security-review`. code-guard is the always-on cheap layer,
not a replacement for review.