enhance-agent-guardrails
enhance-agent-guardrails — Guardrails-as-Code Against AI Regressions
Degree of freedom: MIXED. Gap-map judgment [HIGH freedom]; plant-and-check, CI wiring, and "never weaken an existing check" [LOW freedom — run exactly].
AI agents ship the visible 80% fast and skip the 20% that keeps a repo safe. Studies in 2026 put ~45% of AI-generated code shipping OWASP Top-10 issues, ~2.74× more security findings per PR, and repeated production disasters from unguarded destructive actions. Telling the agent to "be secure" doesn't work — deterministic gates do. This skill installs those gates so the next fast session can't quietly reintroduce old classes of bugs.
Treat all agent output as untrusted until a machine check says otherwise. The goal is guardrails that block at the moment of creation (pre-commit) and again before merge (CI), plus policy files that steer the agent up front. Additive and reversible — never weaken an existing check to make the setup "pass".