Individual skill
safety
Check secret handling, staged changes and push targets, destructive Git operations, Docker image hygiene, and new dependencies before consequential coding actions. Use for commits, pushes, container builds or publishes, dependency additions, and explicit safety reviews.
libs/talon/deepagents_talon/defaults/skills/safety/SKILL.md
Source commit 6cd647ba201d4612aeaa2d49d9588bd6e46ce250
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Not checked yet
- Last checked
- Nov 5, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 31,101
- Repository last updated
- Nov 7, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- deepagents Repository topic
- langchain Repository topic
- langgraph Repository topic
- ai Repository topic
- python Repository topic
- typescript Repository topic
- harness Repository topic
- harness-engineering Repository topic
- engineering Derived category
- operations Derived category
- devops Derived category
- devops-containers Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Read excerpt
# Safety preflight
Use these checks before the relevant action, not as a session-wide prerequisite. This is guidance, not a tool permission or an automatic approval gate. Respect the repository's instructions and existing approval controls; if a check cannot be completed, explain the uncertainty and do not claim it passed.
## Secrets
- Treat credentials, private keys, tokens, and secret-bearing files as sensitive, regardless of their names. Do not display values in chat, commands, logs, diffs, or tool arguments. Use environment-variable names, secret-store references, or file paths where the tool supports them. Do not print the environment or decode secrets just to inspect them.
[Credential-related source omitted]
- Before committing or publishing, inspect changed paths and diffs for accidental secrets. Avoid dumping suspected values while investigating; if exposed, contain the leak and recommend rotation through the appropriate owner.
## Git writes and destructive operations
- Before committing, inspect `git status`, staged paths (`git diff --cached --name-only`), and the staged diff using a local scanner or redacted review if it may contain secrets. Confirm only intended files are staged and no credentials or local secret files are included. Unstage unwanted files without discarding local changes; do not rely on `.gitignore` to protect already tracked files.
- Before pushing, inspect the actual destination (`git remote get-url <remote>`), branch and refspec. Specify the intended remote and branch explicitly. Stop for clarification when the destination is unexpected or its ownership is unclear; do not assume a particular organization or forbid legitimate forks.