Skills that stop AI coding agents from touching production

Repository files navigation

simba-skills

Six skills that stop your AI coding agent from hurting production, and keep its own setup clean.

Made for people who run their apps on their own server (Docker, Postgres, a VPS) and use an AI agent such as Claude Code on that same machine. That setup is convenient, but it means one wrong test run, repro loop or deploy can hit live data. These skills put guard rails around exactly those moments.

Quick start (Claude Code)

1. Add this repo as a plugin source and install it:

        claude plugin marketplace add simbaTmotsi/simba-skills
claude plugin install simba-skills@simba-skills
      

1. Restart Claude Code. That's it. The skills now work in every project.

1. Try one: type /simba-skills:server-maintenance in any session, or just ask Claude to run your tests and watch production-safe-loops check where they will write first.

Using Cursor, Codex, Copilot or another agent? Run npx skills@latest add simbaTmotsi/simba-skills instead. Pick one install method, not both, or you'll get every skill twice.

What's inside

There are two kinds of skill:

• Automatic: the agent uses it on its own when the situation fits. You can also type it.

• You type it: only runs when you type /simba-skills:<name>. Everything that deploys, deletes, or changes settings is in this group, so the agent can never start it by itself.

Examples

• You: "fix the failing signup test." Agent: notices your .env points at the production database, and runs the test against a throwaway test database instead.

• You: /simba-skills:safe-deploy. Agent: finds how this project deploys, lists the commits and migrations going out, asks you to confirm, takes a backup, deploys, checks the logs and health page, and saves a rollback note.

• You: "why isn't my deploy skill showing up?" Agent: finds it was saved as deploy.md instead of deploy/SKILL.md, and offers to move it.

• You: /simba-skills:audit-claude-settings. Agent: backs up your settings, lists the risky rules with secrets hidden, removes what you approve, and reminds you to change any password that was stored there.

Keeping it up to date

Turn on auto-update once and new versions arrive whenever Claude Code starts. Add "autoUpdate": true to this marketplace in ~/.claude/settings.json:

        "extraKnownMarketplaces": {
  "simba-skills": {
    "source": { "source": "github", "repo": "simbaTmotsi/simba-skills" },
    "autoUpdate": true
  }
}
      

Or update by hand at any time:

        claude plugin update simba-skills@simba-skills
      

To remove it: claude plugin uninstall simba-skills@simba-skills.

Tested

The repo includes an eval suite in plugin/evals/ that runs Claude Code on the same scenarios with and without the plugin:

It's a small suite (Claude Code 2.1.323, November 2026), so treat it as a sanity check rather than a benchmark. Run it yourself with claude plugin eval plugin from the repo root.

Data and privacy

simba-skills has no server and collects nothing. Everything runs on your machine, as you. What the skills touch:

Reads and stores (on your machine only)

• server-maintenance backs up your Postgres databases. The backups are full copies, so they contain whatever your databases hold, including any personal data of your users. They are written only to a folder on your server that you choose, and old ones are deleted on the schedule you set.

• report-skill-failure reads your agent session transcripts to describe what went wrong, and saves a redacted draft to ~/.claude/skill-failure-reports/.

• audit-claude-settings, lint-project-skills, safe-deploy and production-safe-loops read your settings, project files, env files and logs to do their checks. Secret values are masked in anything they show.

Sends off your machine (only when you set it up or approve it)

• Alerts to a notification service you choose. server-maintenance can send short alerts (disk nearly full, backup failed) to an ntfy-compatible URL, only if you set NTFY_URL. An alert contains the server's hostname plus either its disk usage and the names of its largest container logs, or the names of the database containers whose backup failed. Never database contents.

• GitHub issues. report-skill-failure posts a redacted bug report to github.com/mattpocock/skills through your own GitHub CLI login, only after you explicitly say yes.

Nothing else leaves your machine. No analytics, no telemetry. Full details: Privacy policy.

Good to know

• Nothing risky happens silently. Every step that deletes, deploys, pushes or installs a scheduled job asks you first.

• Secrets stay hidden. Skills mask passwords and tokens in their output. If one was ever stored in plain text, they tell you to change it, because deleting it is not enough.

• Works on its own. You don't need Matt Pocock's skills. If you have them, production-safe-loops also guards the loops his tdd and diagnosing-bugs skills build.

• Built for Linux servers running Docker. The server and deploy skills assume Docker Compose and Postgres, and adapt to whatever deploy scripts your project already has.

Contributing

Contributions are welcome when they are useful and safe. Read SCOPE.md for the bar and CONTRIBUTING.md for how. In short:

• A skill did the wrong thing? Open a bug report with what you asked, what the agent did, and what you expected.

• Hit a gap in real use? Open an idea before writing code.

• Found a security problem? Report it privately, as described in SECURITY.md.

Every pull request is checked automatically and reviewed by the maintainer before it can merge.

License