skills.rest
cgfixit
cgfixitCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

cgagentharness-config-guard

Validates config.default.yaml against harness security contracts using Rust invariant tests.

Updated Sep 7, 2026
Search Tags:#yaml#config validation#rust tests#loopback#security gates#pre-merge review#invariant checking
One-click install
npx skills add https://github.com/cgfixit/CG-agent-harness --skill cgagentharness-config-guard-cgfixit
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cgagentharness-config-guard
Source: https://github.com/cgfixit/CG-agent-harness/tree/main/.claude/skills/cgagentharness-config-guard
Command: npx skills add https://github.com/cgfixit/CG-agent-harness --skill cgagentharness-config-guard-cgfixit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Changes to assets/config.default.yaml can silently weaken security defaults — quoted booleans flipping flag_is_true semantics, execution gates opening, or loopback posture drifting — and this Skill statically asserts the shipped config still honors every contract the running system assumes before merge. ## Core Features & Use Cases - Contract assertions (H1–H11): Checks flag_is_true semantics, closed execution gates, auth/TLS defaults, memory feature gates, kill-switch behavior, loopback binding, and protected write paths. - Cargo test evidence: Runs tests/invariant_guard.rs and tests/common_layer.rs as the authoritative checker rather than inventing a separate parser. - Pasteable report: Produces a PASS/FAIL verdict with per-gate status and re-tune notes for PR review. - Use Case: Before merging a pull request that edits config.default.yaml, run this Skill to confirm no gate was accidentally opened and no quoted "true" was shipped as ON. ## Quick Start Ask the AI to run the config guard on assets/config.default.yaml and report whether the shipped security gates are still closed.

Frequently Asked Questions about cgagentharness-config-guard

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check config.default.yaml before merging changes?▼

Run the config guard, which executes cargo test --test invariant_guard shipped_config and the flag_is_true tests in tests/common_layer.rs with blanked planner API keys. It reports PASS or FAIL with one line per contract H1 through H11.

What does flag_is_true mean for YAML boolean flags?▼

flag_is_true treats only unquoted YAML true as ON; quoted strings like "true" or "false" are OFF. The guard fails if shipped config relies on quoted booleans, since string forms hide mistakes.

Does the config guard use a Python YAML parser?▼

No. Rust cargo tests are the authoritative checker, and the Skill explicitly forbids inventing a Python parser as the merge gate. A future stdlib or PyYAML companion checker is labeled inference only and never replaces cargo evidence.

Why do the config guard tests fail with API key errors?▼

Planner keys must be blanked before running: set GROK_API_KEY, ANTHROPIC_API_KEY, and DEEPAGENT_API_KEY to empty strings. The tests should never require a developer's real GROK_API_KEY to pass.

Can the config guard edit config to make checks pass?▼

No. It is a read-oriented skill that only reports; it must not edit config solely to silence a check without an authorized change set, and it never opens a shipped gate to green a convenience path.

Related Skills

Explore More Software Engineering Skills→
constellizeconstellize
1

recover-from-staleness-drift

Reconcile memory-bank documentation with the current codebase to restore alignment.

Official
Advanced
localminlocalmin

commit-pr-workflow

Executes commit, push, and pull request workflows following repository conventions.

Community
Intermediate
quaid-appquaid-app
3

Source Seam Invariants

Extract and assert textual invariants at production call sites in Rust codebases.

Official
Advanced
carayacaraya
1

rust-debugging

Diagnose Rust borrow checker, lifetime, type, and runtime issues.

Community
Advanced