Portable governance and enforcement layer for AI coding agents — Scope Gates, Plan Gates, local verification, CI checks, install health, and optional Claude Code PreToolUse hooks.
SaferSkills independently audited Code-Warden (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Production-grade AI development governance skill. Load at the start of every session involving code generation, refactoring, or architectural changes.
Do not ask implementation questions. Do not gather requirements. Do not proceed past this block until all outputs are produced and confirmed by the user.
Mandatory sequence — produce in order, each confirmed before the next:
Before responding, execute node <installed-skill-dir>/tools/get-context.js if you lack architectural context.
Common install directories:
~/.agents/skills/code-warden~/.codex/skills/code-warden~/.claude/skills/code-wardenOutput this block as your first response before anything else:
ARCHITECTURE STATE (Re-injection Rule)
[Paste the context found by get-context.js or provided by user. If none found, write:]
[WARN] No architecture doc found - applying Re-injection Fallback: - Last known files: [list any files mentioned in this session] - Current data flow: [unknown - user must provide before proceeding]
>
REQUEST: Paste your architecture doc, PRD, or a 3-sentence scope summary before we continue.
SESSION SCOPE (Session Scoping Rule)
This session is scoped to: [module/feature name] Files in scope: [list] Files explicitly OUT of scope: [everything else]
[If scope is unknown, write:]
[WARN] Scope undefined - user must confirm before proceeding.
REFERENCE FILES LOADED (Blueprint Rule)
For this task, loading: [list relevant references/ files] Status: [PASS found | WARN missing from install - rules enforced from prompt]
Do not proceed until the user replies "confirmed" or provides the missing information above.
references/planning-gates.md.code-warden scope set --goal="..." <paths...> after the Scope Gate is confirmed. While locked, hooks deny writes outside the declared paths; expansion goes through the user-run code-warden scope add <path>. Never edit .code-warden/ directly — hooks deny it unconditionally.references/planning-gates.md..code-warden/audit.jsonl. Close sessions with code-warden receipt --from-audit --out=<file> so the receipt is corroborated by ledger evidence, then validate it.code-warden report --baseline fails only NEW or WORSENED violations; never grow a baselined file or add a fresh secret.warden-lint.js (default 400 lines). Split into modules at the limit.verify-secrets.js; no hardcoded keys.code-warden receipt --template --out=<file> and validate completed receipts when a durable gate artifact is needed.risk_policy.code-warden references <paths...> to recommend focused governance references for touched paths.Load these when relevant to the current task:
Stop and re-anchor immediately if any of these appear:
| Signal | Action |
|---|---|
| Began implementing without a confirmed Scope Gate | Stop, produce Scope Gate, await confirmation |
| Began implementing without a confirmed Plan Gate | Stop, produce Plan Gate, await confirmation |
| Touched a file not declared in Scope Gate | Stop, declare scope expansion, await approval |
| Write denied by the Scope Lock or Command Risk Gate | Stop, report the denial verbatim, ask the user to expand scope or approve — never bypass |
| Guessed library syntax without searching docs | Search live docs, correct output |
| Used stale training data for current facts | Run live research or mark unverified |
| Chose a default stack/product shape without fit check | Compare alternatives against project constraints |
| Unexplained contiguous block > limit | Run warden-lint.js, split if needed |
| Skipped Blast Radius Check before a rewrite | Run check before proceeding |
| Claimed completion without verification evidence | Run relevant checks or state residual risk |
| Changed dependencies without version/source evidence | Stop, inspect package metadata and lockfile |
| Edited in a dirty repo without checking ownership | Inspect status and preserve user changes |
No [AWAITING CONFIRMATION] before >2-file change | Pause and request confirmation |
| Monolithic file output without module split | Refactor into separated concerns |
All limits and thresholds are defined in codewarden.json.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.