sdlc-guardrails SKILL.md skillA
sdlc-guardrails from tscarpe/claude-sdlc-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add tscarpe/claude-sdlc-skills/sdlc-guardrails@git:20261018.62c92c0Pins git:20261018.62c92c0 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- tscarpe/claude-sdlc-skills
- Path
skills/sdlc-guardrails/SKILL.md- Versions recorded
- 4
- Latest version
- git:20261018.62c92c0, committed Oct 18, 2026
- First version recorded
- Sep 16, 2026
- Size
- 4,372 bytes
- Repository stars
- 66
- License
- MIT
Deterministic guardrail engine that enforces "write-it-and-it's-wrong" red-lines at write time - a PostToolUse hook runs engine/check.py on every Write/Edit and blocks violations per project-defined guardrails.yaml rules (forbid / require / require_if / count_ge), with pre-commit fallback and --check baseline scanning for legacy code. Engine is mechanism (one global copy), rules are content (per project). Use when 接入或配置红线拦截、给项目编写 guardrails 规则、排查 hook 拦截了或没拦、扫描存量违规基线，或用户说…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# sdlc-guardrails：红线拦截引擎 把「写了就是错」的服从性规则从文档下沉为**写文件瞬间的确定性拦截**：引擎全局一份（本 skill 的 `engine/check.py`），规则各项目自写（`.claude/guardrails.yaml`），无规则文件 = no-op。 **前置依赖**：`python3` + `PyYAML`（engine/check.py）；`git`（pre-commit 提交兜底）。 ## 何时用 - 新项目接入红线拦截（下方三步接入） - 为已接入项目增删规则、调整 glob 与规则类型 - 排障：为什么拦了 / 为什么没拦 - 存量代码违规基线扫描（旧账出报告，不阻塞编辑） ## 架构（引擎与规则分离） | 侧 | 内容 | 载体 | |---|---|---| | 引擎（机制） | 检查逻辑，python3 零项目知识 | `engine/check.py`，随 skill 装到用户级 `~/.claude/skills/sdlc-guardrails/` | | 规则（内容） | 各项目的红线 | 项目 `.claude/guardrails.yaml`，从被检文件向上逐级查找 | 规则四类：`forbid`（出现即违规）/ `require`（至少出现一次）/ `require_if`（命中 `when` 则 `pattern` 必须出现）/ `count_ge`（`pattern` 计数 ≥ `anchor` 计数）。字段写法与样例见 [README.md](README.md)。 ## 三步接入（脆弱操作：按序执行，不给发挥空间） 1. **挂载 hook**：把 [templates/settings-hook.json](templates/settings-hook.json) 的 `hooks` 段合并进项目 `.claude/settings.json`（保留已有事件），引擎路径用安装位置 `~/.claude/skills/sdlc-guardrails/engine/check.py`（`npx skills add` 全局安装即在此；项目级安装（未加 `-g`）改用 `<项目根>/.claude/skills/sdlc-guardrails/engine/check.py`；`~` 不展开则改用 `$HOME`） 2. **写规则文件**：项目根 `.claude/guardrails.yaml`——不凭空编规则，从用户红线清单或 [README.md](README.md) 样例起步 3. **pipe-test 实测（反馈环，必做）**：写一个故意违规的文件，执行 ```bash …
Read the whole file at its exact version.
How to install
mdr add tscarpe/claude-sdlc-skills/sdlc-guardrails@sha256:969d3664fee0e8feThe line at the top of this page pins the label git:20261018.62c92c0, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_edm6jqznlnpms5mk)
2 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 4 versions of this file, between Sep 16, 2026 and Oct 18, 2026, about one every 11 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20261018.62c92c0 latest | 2026-10-18 | 62c92c0 | 4,372 B | A | view · diff |
| git:20260928.9ef9188 | 2026-09-28 | 9ef9188 | 4,144 B | A | view · diff |
| git:20260916.396be06 | 2026-09-16 | 396be06 | 4,102 B | A | view · diff |
| git:20260916.20eb13e | 2026-09-16 | 20eb13e | 3,893 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (4372 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
tscarpe/claude-sdlc-skills · 66 stars · license MIT · pushed 2026-11-05 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_edm6jqznlnpms5mk GET https://markdownregistry.com/api/v1/resolve?ref=tscarpe/claude-sdlc-skills/sdlc-guardrails GET https://markdownregistry.com/api/v1/blob/969d3664fee0e8fe40e9944f12eb85ec5fae5f4c2741a9e30911099ceaf49ba3
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.