jay-tank

Yologuard — AI skill for Claude Code

AI community

How to install Yologuard

This entry records only its repository, not the path inside it, so there is no exact command to give. Open jay-tank/yologuard and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Yologuard does

🧩 VS Code extension: Finds AI coding agents launched with permission or sandbox bypass flags where it hurts: CI jobs with secrets, write tokens or issue/PR triggers, untrusted issue and PR text piped into the prompt, scripts and tasks that run on your machine, devcontainers that mount ~/.ssh or docker.sock.

Alternatives in AI

Empryo — Empryo issue tracker + SoulForge (v2) 1.1k ★
Browser Search — A skill for AI agents: search the web with SearXNG, browse with Camofox, bypass protections with CloakBrowser 499 ★
Trading Skills — 17 triggers × 44 algorithms × 3 AI experts — live crypto trading signals for Claude Code, Codex, Cursor & 30+ 113 ★

README

YoloGuard: AI Agent Permission-Bypass Flag Checker

Every AI coding agent has a flag that turns its safety checks off: `claude --dangerously-skip-permissions`, `codex --yolo`, `gemini --approval-mode=yolo`, `cursor-agent --force`, `copilot --allow-all-tools`. On a throwaway VM with no secrets that is fine. The trouble is where these flags end up once a demo turns into a workflow:

on:
  issues:
    types: [opened]
permissions:
  contents: write
jobs:
  triage:
    runs-on: ubuntu-latest
    env:
      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
    steps:
      - uses: actions/checkout@v4
      - run: claude -p "Triage this: ${{ github.event.issue.body }}" --dangerously-skip-permissions

Anyone who can open an issue now writes the prompt for an agent that runs any command it likes, with your API key in its environment and a token that can push to the repository. The same flag in a `postinstall` script, a Makefile target or a dev container that mounts `~/.ssh` runs with the credentials of whoever types `npm install`.

YoloGuard finds every launch of an AI agent CLI with a bypass flag in your workflows, scripts and config files, and rates it by **where it runs**: a CI job with secrets, a write token or issue/PR triggers, an untrusted prompt, your own machine, a container that mounts host credentials, or a real sandbox.

What you see

Problems and squiggles on the exact flag, with a message that says what the flag turns off, what the context exposes (secrets, permissions, triggers, mounts) and the scoped mode to use.
Quick Fixes (lightbulb) where the tool documents a scoped mode: --permission-mode acceptEdits or --permission-mode dontAsk for Claude Code, --sandbox workspace-write for Codex, --approval-mode=auto_edit for Gemini CLI, --approval-mode auto-edit for Qwen Code, --allow-tool=write for Copilot CLI. In argument lists (tasks.json args, compose lists, Dockerfile exec form) the fix uses the single-argume