rwgb/vibe-guardrails

Vibe-guardrails is a plugin for Claude Code, the AI coding assistant, aimed at people who build real projects with AI help but do not have a traditional software engineering background. It adds a set of basic safety habits that experienced engineers already know, so that AI-assisted coding stays recoverable when things go wrong. The plugin includes five skills and one safety hook. The save-points skill teaches you to create git checkpoints before risky changes, so you can always roll back. The project-memory skill keeps a running log file so each new coding session starts with context instead of starting from scratch. The before-you-build skill runs a short check for what could go wrong before you start building something non-trivial. The done-checklist skill gives you a concrete definition of what counts as finished, rather than stopping once something merely runs on your machine. The keep-secrets-secret skill checks for API keys and credentials before they end up committed to your code or git history. The safety hook watches every shell command Claude Code is about to run and blocks a short list of commands that would permanently destroy work, such as force pushes, hard resets, and recursive deletes on risky paths. When it blocks a command, it explains what would have been destroyed and suggests what to do instead. Installing it takes two commands inside Claude Code to add the plugin marketplace and install the plugin, followed by a restart so the hook and skills load. During installation you will see a trust prompt, since the plugin runs a small shell script before each command, the entire plugin is plain text in the repository, so you can review it before agreeing. The author is upfront about its limits. It is not a full security audit, since the secrets check only catches common patterns like API keys and passwords. It is not a substitute for learning software engineering fundamentals. The safety hook is best effort: it recognizes a specific list of destructive commands and deliberately allows anything it does not recognize to pass through, rather than risk blocking something that should work. Save points remain the real safety net. The project is written mostly in Shell script and is released under the MIT License.