Fail-Closed Guards — Catch Dead Safety Checks Before Prod
The guard is dead code, and nobody notices until the incident it was meant to stop.
Free
Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+21 moreClaude CodeCursorCodex CLIMuseDots
Manus
Grok
Grok Bot+18 agentsFail-Closed Guards — Catch Dead Safety Checks Before Prod
Example session with this skill installed
I added a rate-limit guard to our payout retry worker so it can't resubmit within 30 seconds. Review it with fail-closed-guards before I merge:
last = job.meta.get("last_submit_at", 0)
if time.time() - last < 30:
return skip("too soon")
submit_payout(job)
- Read your context and instructions
- Compiled the fail-closed guards
fail-closed-guards review — payout retry guard
- Data the guard depends on: job.meta["last_submit_at"]
- When missing: key absent → default 0
- Predicate on missing: time.time() - 0 ≈ 1.7e9, which is not < 30 → "too soon" is False → submit_payout runs
- ❌ FAIL-OPEN. A job with no stamp is always treated as "long ago" and resubmits immediately. This is a refuse-if-recent guard, so the safe default is "just now":
last = job.meta.get("last_submit_at", time.time())
A missing stamp now refuses for 30 s instead of allowing. - Write-sites for last_submit_at (grep):
- workers/payout.py:88 submit_payout() → stamps after the API call ✅
- workers/payout.py:131 manual_resubmit() → does NOT stamp ❌
- jobs/requeue.py:42 copies meta but drops last_submit_at ❌
Fix both, and stamp BEFORE the API call so a crash mid-request can't leave the job unstamped.
- Add a log line on the missing-field branch:
log.warning("guard refused: last_submit_at missing", job_id=job.id)
Verdict: do not merge until steps 4 and 5 are fixed. With the current code, any requeued job can double-submit a payout.
Connects securely to your tools. The creator never sees your data.
About this skill
What it does
A guard like if now - state.get("t", 999.0) > 4: allow() looks like protection, but if nothing ever stamps "t", the fallback makes the predicate true on every call. The guard is dead code, and nobody notices until the incident it was meant to stop. Fail-Closed Guards makes your agent check every gate for this.
The rule:
- Work out what the guarded value is when data is missing (unset key,
None, race, optional field). - Pick the default so the predicate on that missing value is False (refuse).
- Grep every write-site and confirm each one actually sets the field. Otherwise a fail-closed default just hides a field that's never populated.
It covers the subtle case where the safe default flips with the predicate's direction (a "too soon, refuse" guard needs a default of now, not 0), plus permission defaults (guest, never admin) and feature flags (default OFF). It also says when not to apply the rule (perf tuning, UI defaults, legacy shims).
When to use it
- Writing or reviewing any guard, permission check, gate or precondition on a sensitive action
- Spotting
dict.get(k, DEFAULT),x or DEFAULTorgetattr(o, "x", DEFAULT)feeding anif - Debugging a guard that "never fires"
What's inside
SKILL.md: the rule, the canonical anti-pattern with a before/after fix, a 6-step checklist (including logging the "fired because missing" path), worked examples (reject-if-recent, permissions, feature flags), when-not-to-apply cases, and install/invoke prompts. Works with Claude Code and any SKILL.md-compatible agent.
How to use
- 1
Connect your agent to the Agensi MCP
Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup
- 2
Sign in to Agensi
Your agent shows a sign-in link. Sign in and click Allow.
- 3
Ask for what you need
Your agent loads this skill and uses it on your task. It always asks before any payment.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill goes through the trust checks below.
Security scanned
Checked by our 8-point scan before listing
Fresh listing
Recently published to Agensi
Free forever
No account required to browse
Trust & safety
Security scan
Security scan passed today
- Free with an Agensi account