Guard

Before you ship an agent workflow to production, this skill helps you add the safety rails you'll actually need: input validation, PII filtering, cost budgets, and permission checks. It walks through threat assessment (prompt injection, data leakage, cost explosion), then gives you concrete guard patterns for inputs, outputs, costs, and permissions. The checklist is practical: validate everything, scan for sensitive data, set spending limits, require confirmation for destructive actions. If you're deploying anything that touches real data or makes real API calls, you want these guardrails in place before things go sideways.

skills.sh installs: 351
GitHub stars: 602
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add sharpdeveye/maestro --skill guard --agent claude-code

Installs into .claude/skills of the current project.

Files

MANDATORY PREPARATION

Invoke /agent-workflow — it contains workflow principles, anti-patterns, and the Context Gathering Protocol. Follow the protocol before proceeding — if no workflow context exists yet, you MUST run /teach-maestro first.

Consult the guardrails-safety reference in the agent-workflow skill for the full defense-in-depth framework.

Add safety boundaries to a workflow. Guards protect against malicious inputs, unintended outputs, data leakage, cost explosion, and all the ways an autonomous system can go wrong in the real world.

Threat Assessment

Before adding guards, understand what you're protecting against:

Threat	Risk Level	Guard Type
Prompt injection	High	Input sanitization, instruction hierarchy
PII leakage	High	Output filtering, data masking
Cost explosion	High	Token budgets, rate limits
Unauthorized actions	Medium	Permission scoping, confirmation gates
Hallucination	Medium	Source attribution, fact checking
Service abuse	Medium	Rate limiting, authentication