If you're shipping features with Claude Code or Cursor, you've probably noticed the pattern: the agent nails the happy path, the tests pass, and then three days later you find the error handling is missing, the docs are stale, or a function is 150 lines doing five different things.
That's not a skill issue — it's a systematic bias. LLMs optimise for code that looks done. Guard skills are a second pass that specifically hunts for those gaps.
What Guard Skills Actually Are
guard-skills is an open-source Agent Skill package. It's a set of focused review skills you invoke after your agent produces code — not as part of generation, but as a separate quality gate.
The idea is straightforward: let the agent write code, then run a guard on the diff before you commit. The guard is specifically prompted to find the failure modes that AI code generation is prone to — not the things a generic "review this" prompt would catch.
Five guards currently available:
$clean-code-guard— structure, naming, complexity, single responsibility$test-guard— coverage gaps, test quality, missing edge cases$docs-guard— stale docs, missing context, misleading comments$wp-guard— WordPress-specific patterns and security$woo-guard— WooCommerce checkout-specific issues
Setting It Up
# Install specific guards for Claude Code
npx skills add amElnagdy/guard-skills --skill clean-code-guard --agent claude-code
npx skills add amElnagdy/guard-skills --skill test-guard --agent claude-code
# Or install everything globally
npx skills add amElnagdy/guard-skills --global
Once installed, you invoke a guard like any skill:
Use $clean-code-guard on the diff you just produced.
Use $test-guard on the tests you just wrote.
You can also run it proactively during generation:
Use $clean-code-guard while implementing this endpoint, then self-check before delivery.
The reactive pass — agent writes, you review, guard verifies — is where it earns its keep.
Why a Separate Pass Matters
The key insight is that reviewing and generating are different cognitive tasks with different failure modes.
When you ask Claude Code to "write a function and make sure it handles errors properly", generation dominates. The model allocates most of its attention to making working code. The review constraint is there but secondary.
When you invoke a guard on the completed diff, the model's entire focus is finding problems. It has the code, it knows what it's looking for, and it's not simultaneously trying to make something work.
This is the same reason humans do code review on pull requests rather than trusting their own edits. The authoring mode and the reviewing mode are genuinely different.
For TypeScript/Next.js projects specifically, $clean-code-guard is where I'd start. AI-generated Next.js code has predictable failure modes: components that fetch data when the parent could pass props, unnecessary 'use client' directives on server components, useEffect where a server action would do. The guard surfaces these before they calcify into the codebase.
What I'd Build With This
A pre-commit hook wrapper. Run $clean-code-guard on git diff --cached automatically before every commit. If the guard flags anything, fix it before it goes through. Full automation of the review loop without adding to CI wait time.
A CI quality gate step. Add a guard review step to a GitHub Actions pipeline that posts inline PR comments via gh pr review. Flag issues automatically without requiring a human reviewer for every AI-generated change.
A project-specific guard. The architecture here is just a skill definition file. Fork it, write a $nextjs-guard that checks for patterns specific to your codebase: correct Supabase client selection, rate limiting on AI routes, next/font instead of CSS imports. Codified institutional knowledge that travels with the repo.
My Take
The thing I find most interesting about guard-skills isn't the specific guards — it's the pattern of separating generation from verification. That's how serious engineering teams should think about AI tooling: use the agent for high-velocity generation, then apply focused verification passes that know exactly what to look for.
The guards are lightweight enough that running one costs less than a minute. The ROI is catching the thing you'd otherwise discover in production.
Worth a five-minute setup if you're already inside Claude Code.