dcg
FeaturedDiagnose a Destructive Command Guard block or configure its rules. Use when: DCG rejected an operation or policy work is requested; never disguise commands to bypass it.
Install
Quality Score: 91/100
Skill Content
Details
- Author
- boshu2
- Repository
- boshu2/agentops
- Created
- 10 months ago
- Last Updated
- today
- Language
- Go
- License
- Apache-2.0
Bundled in these plugins
Similar Skills
Semantically similar based on skill content — not just same category
blocked-form
Use when a guard, hook or sandbox refuses a destructive command and you are about to record the action as blocked, escalate it, or leave a ticket waiting. Read the refusal text first.
block-destructive-commands
Best-effort guard against destructive commands: rm -rf targeting absolute, home ($HOME/~) or root-adjacent paths (and the PowerShell Remove-Item -Recurse equivalent); git push --force (not --force-with-lease); git reset --hard; git clean -f; kubectl delete; terraform destroy; aws s3 rm --recursive / rb --force; dropdb; helm uninstall/delete; docker volume rm/prune and system prune; gcloud ... delete. Destructive verbs are matched position-aware, so a bucket, path or object NAMED like a verb (aws s3 cp ... rm, docker volume inspect rm, helm list delete) is allowed. Known bypass classes include aliases, quoted arguments, non-standard clients, and scripts that invoke these commands indirectly. This is friction, not a security boundary.
rules
Reference for Anchorwatch guardrail rules and how to respond when a tool call is blocked. Use when a command or edit was denied with "Anchorwatch blocked", or when the user asks what Anchorwatch protects against.