safe-project-rules

safe-project-rules 是一个个人 Codex skill，用于在进入新项目开发前，生成保守、项目化的安全开发规则。

它适合 PM、AI 编程新手、以及使用 Codex / Cursor / Claude Code / 多 Agent 协作开发的场景。这个 skill 会先扫描项目结构、分支、部署方式、数据库风险、已有脏改动和多 agent 协作风险，再生成适合当前项目的本地规则文档，降低误改文件、夹带历史改动、误推生产、误操作数据库、文档过期、agent 互相覆盖等事故概率。

中文说明

它解决什么问题

• AI 没看项目结构就直接改代码
• PM 或新手开发时误改高风险文件
• 当前工作区已有脏改动，被误提交进去
• 数据库 SQL / 批量脚本 / 导入任务缺少确认和回滚
• 发测试前没有自测报告或发布方案
• 多个 agent 轮流开发时，文件归属不清、互相覆盖、夹带未验证改动
• 文档、接口说明、规则文件在功能变更后没有同步
• 日志、报告、上下文越来越长，影响后续判断

默认会生成什么

默认生成三类本地规则文档：

1. 短红线规则

   • 每次修改代码前必读
   • 要求先输出开工前安全声明 / Change Contract
   • 约束分支、脏改动、高危路径、数据库、推送、生产环境、多 agent 接手边界

2. 自测门禁规则

   • 功能改完后、提交前、发测试前执行
   • 覆盖 diff 安全扫、语法 / lint、本地冒烟、安全加严、轻量洁癖、多 agent 交接检查
   • 要求输出自测报告，未通过不得提交或发测试

3. 发测试规则

   • 准备合入测试分支、推送测试环境或发测试时使用
   • 要求先完成自测，再输出测试发布方案
   • 覆盖发布范围、数据库顺序与回滚、配置 / 队列、冒烟用例、风险与回滚、日志摘要

什么时候使用

• 第一次接手一个新项目
• 项目还没有明确的 AI agent / Cursor / Codex 开发规则
• PM 需要参与代码开发，但希望每次修改前有安全护栏
• 一个项目会使用多个 agent 轮流开发、复查、验收或发测试
• 项目包含数据库、CI、部署脚本、生产分支、环境配置等高风险内容
• 现有规则太通用，缺少项目真实路径、分支、命令和发布流程

安装

克隆仓库后，把 skill 文件夹复制到 Codex skills 目录：

git clone https://github.com/JenayNing/safe-project-rules.git /tmp/safe-project-rules
mkdir -p ~/.codex/skills
cp -R /tmp/safe-project-rules/safe-project-rules ~/.codex/skills/

如果已经在仓库根目录，也可以直接复制：

mkdir -p ~/.codex/skills
cp -R safe-project-rules ~/.codex/skills/

使用方式

在新项目根目录打开 Codex，然后输入：

Use $safe-project-rules to inspect this project and generate local safety development rules before coding.

如果希望生成 Cursor 规则：

Use $safe-project-rules to inspect this project, then generate Cursor rules under .cursor/rules.

如果希望先看方案、不直接写文件：

Use $safe-project-rules to inspect this project and list the proposed safety rule documents first. Do not write files until I confirm.

设计原则

• 先识别项目，再写规则
• 宁可停下来确认，也不要继续冒险
• 保护已有脏改动，不夹带无关文件
• 把多 agent 开发视为共享现场
• 规则必须项目化，不能只写泛泛建议
• 只做轻量洁癖，不借机扩大重构
• 日志只保留关键错误、命令、路径和验证摘要
• 中文和多语言文件默认使用 UTF-8

---

English

safe-project-rules is a personal Codex skill for generating conservative, project-specific safety development rules before coding.

It is designed for PMs, beginner developers, and AI-assisted development workflows where Codex, Cursor, Claude Code, or multiple agents may modify a project. The skill inspects a project first, then generates local rules that reduce the chance of unsafe edits, dirty-worktree accidents, database mistakes, production pushes, stale documentation, and multi-agent handoff issues.

What It Generates

By default, the skill generates three kinds of local rule documents:

1. Short redline rules

   • Read before every code change
   • Require a pre-change safety statement / change contract
   • Guard branches, dirty worktrees, high-risk paths, database actions, pushes, production environments, and multi-agent takeover boundaries

2. Self-test gate rules

   • Run after implementation and before commit or test release
   • Cover diff safety, syntax/lint checks, local smoke tests, security checks, lightweight neatness, and multi-agent handoff checks
   • Require a self-test report before commit or test release

3. Test-release rules

   • Run before merging or pushing to a test/release environment
   • Require a release plan with scope, rollback, database impact, config/queue impact, smoke cases, logs, and production exclusions

When To Use

Use this skill when:

• Starting work in a new or unfamiliar project
• A project does not yet have local AI-agent development rules
• A PM or beginner developer will participate in code changes
• Multiple agents may work on the same project
• The project has CI, deployment scripts, database scripts, environment files, production branches, or other high-risk areas
• Existing rules are too generic and need project-specific paths, branches, commands, and release flow

Installation

Clone this repository and copy the skill folder into your Codex skills directory:

git clone https://github.com/JenayNing/safe-project-rules.git /tmp/safe-project-rules
mkdir -p ~/.codex/skills
cp -R /tmp/safe-project-rules/safe-project-rules ~/.codex/skills/

Usage

In a project root, ask Codex:

Use $safe-project-rules to inspect this project and generate local safety development rules before coding.

To generate Cursor rules:

Use $safe-project-rules to inspect this project, then generate Cursor rules under .cursor/rules.

To review before writing files:

Use $safe-project-rules to inspect this project and list the proposed safety rule documents first. Do not write files until I confirm.

Repository Structure

safe-project-rules/
  SKILL.md
  agents/openai.yaml
  references/rule-set-template.md
README.md
LICENSE

License

MIT