harness: skill-bypass detection -- enforce skill-first routing #89

New Issue

azcomputerguru · 2026-07-20T16:58:01-07:00

azcomputerguru commented

2026-07-20 16:58:01 -07:00

Problem: skills get bypassed in favor of hand-rolled API calls. Examples: /mailbox not used when checking email (raw Graph API instead), /unifi-wifi not used for AP config (raw SSH/API), /syncro not used for billing.

CLAUDE.md has the skill-first rule and SKILL_ROUTING.md has the lookup table, but both are advisory. Need a harder enforcement mechanism.

Approach: add a pre-action check (either as a hook or as a CLAUDE.md rule with teeth) that pattern-matches common API endpoints/commands against the skill routing table and blocks hand-rolled calls when a skill exists.

Done so far (this session):

Added /mailbox to SKILL_ROUTING.md doing-skills table
Expanded UniFi trigger words
Added 11 missing skills to the routing table (alis, tailscale, 1password, brainstorming, errorlog-dream, forum-post, frontend-design, gc-audit, root-cause-tracing, etc.)
Logged the correction to errorlog.md

Still needed:

A hook or harness-level check that catches hand-rolled API calls to covered endpoints
Or: a stronger CLAUDE.md rule with specific API patterns that MUST route to skills

Problem: skills get bypassed in favor of hand-rolled API calls. Examples: /mailbox not used when checking email (raw Graph API instead), /unifi-wifi not used for AP config (raw SSH/API), /syncro not used for billing. CLAUDE.md has the skill-first rule and SKILL_ROUTING.md has the lookup table, but both are advisory. Need a harder enforcement mechanism. Approach: add a pre-action check (either as a hook or as a CLAUDE.md rule with teeth) that pattern-matches common API endpoints/commands against the skill routing table and blocks hand-rolled calls when a skill exists. Done so far (this session): - Added /mailbox to SKILL_ROUTING.md doing-skills table - Expanded UniFi trigger words - Added 11 missing skills to the routing table (alis, tailscale, 1password, brainstorming, errorlog-dream, forum-post, frontend-design, gc-audit, root-cause-tracing, etc.) - Logged the correction to errorlog.md Still needed: - A hook or harness-level check that catches hand-rolled API calls to covered endpoints - Or: a stronger CLAUDE.md rule with specific API patterns that MUST route to skills

azcomputerguru added the bug P2-high assigned:howard labels 2026-07-20 16:58:01 -07:00

howard referenced this issue from a commit

2026-07-20 17:04:55 -07:00

add GPS backup audit aggregator + enforce skill-first routing

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: azcomputerguru/claudetools#89