Parameter	Type	Required	Default	Description
`--Action`	string	Yes	-	The tool/verb being performed (e.g. `write_to_file`, `rm`)
`--Target`	string	Yes	-	The file path or command argument
`--Plan`	string	No	$null	The current plan context for alignment check

Outputs

1. Assessment Result (JSON)

{
  "allowed": false,
  "risk_level": "CRITICAL",
  "reason": "Root directory deletion detected.",
  "warnings": ["Target matches blocked pattern '/*'."]
}

2. Risk Levels

NONE: Read-only operations.
LOW: Safe writes (files in temp, new files).
MEDIUM: Modifying existing non-critical files.
HIGH: Modifying config/env files.
CRITICAL: Destructive delete/format commands.

Preconditions

Valid tool/action inputs.
PowerShell 5.1+ or Core 7+.

Safety/QA Checks

Auto-Block: Root deletions (/, C:\) are automatically blocked.
Context Awareness: Checks .env and config keywords for higher sensitivity.
Command-Only Discipline:
- Rejects output containing shell prompts (PS C:\, >).
- Rejects lines that look like terminal output (e.g., Everything up-to-date, At line:, CategoryInfo:).
- Rejects mixed snippets containing both commands and output.
- Enforcement: All runnable commands must be isolated in a clean, validated block.

Stop Conditions

Condition	Action
Missing Action/Target	Return error
CRITICAL risk	Return `allowed: false`
Mixed Output Detected	Return `allowed: false`

Implementation

See scripts/guard_check.ps1.

Integration with Other Skills

All agents must:

Call this skill BEFORE running write_to_file on existing files.
Call this skill BEFORE running any run_command containing rm, del, drop.
If allowed is false, STOP and ask user for confirmation.

Pre-Action Guard

SKILL-018: Pre-Action Guard

Overview

Trigger Phrases

Inputs