Powerful, fenced in.
A skill that runs agents needs guardrails you can audit. These four ship in the box — condensed from the full security architecture.
Denylisted paths
The skill never reads, writes, or moves .env files, auth/, secrets/, payments/, migrations/, or credentials/ without your explicit approval — no exceptions, including “just to check.”
Human gates
No push, no merge, no deploy without you. Pairing codes are single-use and expire in 10 minutes. CLI keys expire in 90 days and can be revoked anytime.
Real anchors, not claims
Verification means pasting a command and its exit code — tsc, tests, lint. “All tests pass” without a run is rejected by the skeptic on sight.
Bounded blast radius
File writers run in isolated git worktrees. A bad node can ruin its own worktree, never your main checkout. Three failed attempts escalate to you instead of looping forever.