How to Use AI Agent Skills Safely at Scale

TL;DR

Install programmatic guardrails before running AI agents with skipped permissions, then isolate parallel coding work with Git worktrees and move suitable autonomous agents onto separate VPS environments. These skills reduce destructive-command risk, prevent agents from competing over the same files, and simplify remote recovery, updates, and management across multiple agent installations.

Transcript

My name is David Andre and over the past 3 years I've spent well over 2,000 hours coding with AI agents and 3 weeks ago I decided to open source my skills repo for all of the different agentic skills I use whether it's for Codex, Claude Code, Pi Agent, Hermes, everything. And when I did this the repo blew up and instantly became my most popular Git... Read More

Key Insights

• Agent skills are instructions written primarily for AI systems, although they should remain understandable to humans. Their purpose is to give agents tested procedures for recurring tasks, allowing users to steer agent behavior more consistently across tools such as Codex, Claude Code, Pi Agent, and Hermes.
• Effective agent operation depends on control and affordability, according to the presentation. Skills improve control by documenting repeatable workflows, reducing uncertainty, and teaching agents how to perform specialized tasks without requiring the user to repeatedly explain every operational detail.
• Global agent guardrails are the recommended first skill for agents running with skipped permissions. The skill installs hooks that examine tool calls before execution, creating a programmatic safety barrier rather than relying only on written instructions that an agent might fail to follow.
• Pre-tool-call hooks block dangerous command patterns before those commands run. The covered patterns include deletion aimed at system locations, disk destruction, fork bombs, internet content piped directly into a shell, remote Git history rewriting, remote branch deletion, and broad ownership or permission changes.
• Guardrails can distinguish dangerous operations from legitimate maintenance. The presented configuration allows actions such as recursively deleting a node_modules directory while denying recursive deletion aimed at an entire machine, home folder, or other sensitive system-wide target.
• Git worktrees isolate parallel coding agents by placing each agent in a separate directory and Git branch. This prevents agents from fighting over the same files and becomes particularly important when more than five agents are working in one repository.
• Worktree setup must include required supporting files, such as environment files, so an isolated agent can operate like the primary checkout. The skill also covers location detection, worktree creation and removal, completion marking, setup automation, and the overall parallel-working model.
• VPS server management isolates agents from a user's primary computer and centralizes remote administration. The skill instructs an agent to connect through SSH or Tailscale, navigate Hermes and Open Claw installations, recover crashed agents, update models, and manage multiple remote environments.

Questions & Answers

Q: How should AI agents be protected when permissions are skipped?

AI agents running with skipped permissions should first be configured with global agent guardrails. The described skill installs pre-tool-call hooks that inspect each proposed command and reject dangerous patterns before execution. This provides programmatic enforcement against destructive actions such as system-wide recursive deletion, disk destruction, fork bombs, remote Git history rewriting, and unsafe internet-to-shell pipelines.

Q: Why are prompt-based safety instructions insufficient for AI agents?

Prompt-based instructions depend on the agent consistently interpreting and following written guidance, which the presentation says is not strong enough for high-risk operations. A pre-tool-call hook adds an enforcement layer outside the agent's reasoning process. It checks proposed commands before they run and denies matching dangerous patterns, reducing the chance that skipped permissions lead to destructive execution.

Q: What dangerous commands should AI agent guardrails block?

The guardrails should block commands aimed at deleting system roots, entire home folders, or broad user directories. They should also deny disk-destroying operations, deletion with administrative power, fork bombs, piping internet content directly into a shell, rewriting remote Git history, deleting remote branches or tags, broad permission and ownership changes, and destruction of reflog protections.

Q: Can AI agent guardrails allow legitimate recursive deletion?

Yes. The described guardrails distinguish between an acceptable cleanup operation and a destructive system-wide command. Recursively deleting a frequently regenerated dependency directory such as node_modules can be permitted, while recursive deletion targeting the entire machine, a home folder, or another sensitive location should be rejected before execution. The rules therefore depend on both the operation and its target.

Q: Why should parallel AI coding agents use Git worktrees?

Git worktrees keep parallel agents from competing over the same files by giving each agent a separate directory connected to its own Git branch. This isolation allows multiple agents to work on one repository without sharing a single mutable checkout. The presenter says worktrees become especially important when more than five agents are operating in the same repository.

Q: What should an AI agent's Git worktree setup include?

A worktree setup should begin by detecting the current repository and then create a separate checkout location and Git branch for the assigned agent. Required supporting files, including environment files, should be copied when the isolated agent needs them. The workflow should also define how to remove worktrees, mark work as completed, and automate repeatable setup tasks.

Q: Why run autonomous AI agents on separate VPS environments?

Separate VPS environments give agents full computers while isolating them from the user's primary machine and from other agents. This reduces concern about an agent deleting local files or competing with another process. The presenter uses separate VPS installations for different Hermes and Open Claw workflows, including personal tracking, task management, and priority-list activities.

Q: How can an AI agent manage multiple VPS installations?

The VPS server management skill teaches an agent how to connect to remote environments through SSH or Tailscale and navigate Hermes or Open Claw installation folders. From a local agent interface, the user can request recovery of a crashed remote agent or an update to a newly available model, avoiding the need to administer every VPS manually.

Summary & Key Takeaways

• Agent skills are detailed instructions designed primarily for AI agents while remaining readable by humans. David Andre says his open-source repository contains more than 42 skills developed from over 2,000 hours of coding with agents. The supplied transcript focuses on guardrails, Git worktrees, and VPS server management as foundational capabilities.

• Global agent guardrails use pre-tool-call hooks to inspect commands before execution and programmatically deny dangerous patterns. The examples include destructive recursive deletion, disk-destroying commands, fork bombs, remote Git history rewriting, broad permission changes, and piping internet content into a shell, while still allowing legitimate operations such as deleting dependency directories.

• Git worktrees give parallel agents separate directories and Git branches so they do not compete over shared files. VPS server management provides another isolation layer and teaches an agent how to connect through SSH or Tailscale, navigate supported setups, recover crashed agents, and update models across multiple remote agent installations.