/seatbelt

name: seatbelt
description: '[Adam''s Skills] Sets up the security foundation that lets you run Claude Code fast — auto mode, custom tools, minimal interruptions — without it doing something irreversible you never asked for. Two modes. Developer, a permissive default plus a thin deny-only brake on the genuinely irreversible. Vibe, deny-by-default for people who don''t know git, so code changes flow freely while merges, force-pushes, deploys, secret reads and spend are blocked at the Claude layer. Grounds itself in the repo''s existing Claude settings, instructions, MCP servers and CI before writing anything, and writes to gitignored local settings so technical and non-technical people can share one repo on different terms. Use when setting up a project for AI-assisted development, when handing a repo to a non-technical builder, or when the user says they want Claude to stop breaking things, worries it will delete their work, or wants to run auto mode with confidence. Aliased as /seatbelts.'
allowed-tools: Read, Write, Edit, Bash, Glob, Grep, AskUserQuestion
disable-model-invocation: true

Seatbelt

A seatbelt doesn't limit how fast you drive. It's what lets you drive fast at all.

This skill writes a per-person permission policy for the current repo so Claude can be given more autonomy, not less. It is the collection's only **mutating** skill — everything else here is read-only. For a read-only report on this repo's AI setup, use `/context-audit` instead; this skill deliberately has no dry-run mode, because that would just be `/context-audit` again.

**What it honestly does:** stops Claude over-reaching. **What it does not do:** stop a person who dismantles their own setup. Say this to the user; never let them believe otherwise.

**Explicit invocation only** (`disable-model-invocation: true`). Never offer or auto-run this because a user sounded worried, said Claude broke something, or challenged a change. A developer with their own permission setup would find an uninvited rewrite of it worse than the problem they were complaining about. It runs when someone types `/seatbelt`, and not otherwise.

Quick start

/seatbelt              # asks which mode, then sets up
/seatbelt --developer  # skip the question
/seatbelt --vibe       # skip the question
/seatbelt --allow "npm run deploy:staging"   # add one override
/seatbelt --uninstall  # remove exactly what the manifest records

`--developer` and `--vibe` together is an error, not a silent pick. `--uninstall` beats mode flags. With no TTY and no mode flag (headless, or running as a subagent), print what you would have asked and exit non-zero — never guess a mode.

Workflow

1. Ask the mode first

Before any grounding. A wall of stack-detection output is the worst possible first screen for a non-technical user, and the question costs nothing to ask early.

Frame by **consequence, not identity**. "I know what a PR is" biases everyone toward the mode with no brakes, because everyone wants fewer prompts. Use `AskUserQuestion` with:

• **Let Claude move fast** — it can push, merge and deploy on its own. Pick this if you can read

a diff and undo a bad merge.

• **Keep a human in the loop** — Claude writes code freely, but anything permanent (merging,

deploying, deleting) waits for you.

If you already know the repo has CI, a committed lockfile, or several contributors in `git log`, pre-select the matching default and ask them to confirm it rather than choose cold.

2. Ground

Read before deciding anything. Reuse `/context-audit`'s read list rather than restating it (`CLAUDE.md` at every level, settings at every scope, `.claude/agents/`, project memory), then add:

git rev-parse --git-common-dir          # worktrees: .git/hooks/** is NOT where you think
git config --get core.hooksPath         # relocatable; deny the resolved path
git symbolic-ref refs/remotes/origin/HEAD
command -v gh node; gh auth status
cat .gitignore

Also enumerate connected MCP servers (`.mcp.json`, `~/.claude.json`, `claude mcp list`) and the repo's manifests for a `deploy`-shaped script. Compute the **effective** policy across all four settings scopes — a pre-existing user-scope `deny`, or a `settings.local.json` carrying `defaultMode: bypassPermissions`, silently defeats whatever you write, and the user will blame this skill. Report the effective result, not the written one.

Render the summary at the audience's reading level. In vibe mode that is at most: *"This looks like a Next.js site. I found your test command. You have no safety rules set up yet."*

3. Write

Everything goes in **`.claude/settings.local.json`** — gitignored, personal. One repo can hold both a developer and a non-technical builder, so the policy belongs to the person, not the project.

Non-negotiables, each one a verified footgun. Full detail in [REFERENCE.md](REFERENCE.md):

• **Verify `.claude/settings.local.json` is gitignored and add the entry if missing.** This is

mechanical, not tidiness: a `settings.local.json` a repository could have supplied goes through the workspace-trust dialog; a personal one does not.

• **Never rewrite an existing `.claude/settings.json`.** Read it, fold it into the effective

policy, and only propose additions as a diff the user approves.

• **Never emit `Write(path)`, `NotebookEdit(path)` or `Glob(path)` rules.** They are accepted and

never matched — a silent no-op that would make your final report claim protection that does not exist. Use `Edit(path)` and `Read(path)`, relative-anchored (`Read(./.env*)`), never absolute.

• **MCP matchers need a trailing `.*`.** `mcp__github` matches nothing; `mcp__github__.*` matches

the server. The irreversible acts vibe mode exists to prevent are often one MCP call away and touch neither Bash nor `gh`.

• **Copy `assets/guard.mjs`, never generate it.** It is tested code. Register it in

`settings.local.json` in **exec form** with a scoped matcher, an `if` filter and a `ti