operating-safely skill (riekelt): look before you delete, ask before you restart

Makes Claude look before it deletes, ask before it restarts anything live, and never read or print secret values.

Installs: 20.3K; on skills.sh
Stars: 7; on GitHub
Updated: Sep 2026; last repo commit

operating-safely covers actions that touch live systems, shared state or things that do not come back: deleting, overwriting, restarting, killing processes, editing shared config, handling secrets and working beside concurrent sessions. It tells Claude to look at the target before deleting, prefer targeted operations over bulk ones, ask the operator before restarting live services, and check names and structure of secrets without reading their values. Its description says to use it before the destructive command, not after. It names principal-engineering as required background.

Good for

Developers who let Claude run shell, database or deploy commands
Teams sharing a checkout between people or parallel agent sessions
Anyone working near production data or secrets

Install operating-safely

Claude Code

Copy this prompt.

Install the operating-safely skill in Claude Code. Run this command:

/plugin marketplace add riekelt/principal-engineer
/plugin install principal-engineer@principal-engineer

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Pick one route. The plugin installs all 11 skills in the repo, plus one agent (change-verifier) and two commands (/verify and /preflight), counted from the git tree. operating-safely names principal-engineering as required background, so the skills CLI and folder routes below install both. There is no Claude app upload route: the README documents only the Claude Code plugin and the other-agents routes.

From the project README. Source.

What's in the skill

When it loads

Use when an action touches live systems, shared state, or things that do not come back - deleting, overwriting, restarting, killing processes, editing shared config, handling secrets, or working beside concurrent sessions. Encodes the destructive-op guards, secrets hygiene, and concurrent-session safety. Use before the destructive command, not after, even when the command looks routine.

Sections in SKILL.md

Overview
Destructive operations
Secrets
Concurrent sessions and shared state
Shared config and resources
Confirmation authority and incident mode
Common mistakes

Key facts

Author: riekelt (named as author in the plugin manifest)
License: MIT per the README and plugin.json; the repo has no LICENSE file and GitHub shows none
Installs on skills.sh: 20,312 (Nov 2, 2026)
GitHub stars: 7 for the whole riekelt/principal-engineer repo (Nov 2, 2026)
Last repo commit: Sep 11, 2026
Audits on skills.sh: Gen Agent Trust Hub: pass, Socket: pass, Snyk: pass
What it includes: 1 file: SKILL.md (counted from the git tree)
Part of: The principal-engineer plugin: 11 skills, 1 agent and 2 commands (counted from the git tree)
Needs: The principal-engineering skill, named as required background in SKILL.md
Works in: Claude Code via the plugin; other agents via a plugin loader or symlinked skill folders, as the README describes

What it includes

Looks at the target first and prefers targeted over bulk deletes
Five rules: look at the target, targeted over bulk, the operator owns live process lifecycles, state the cost of the wrong order, database changes need their own confirmation.
Read · Destructive operations
Names and structural checks only; never read, print or decrypt values
Existence and emptiness are structural. Exact length, prefixes and fragments count as leakage. If secret tooling fails, Claude pauses.
Read · Secrets
Never reverts or commits files it did not change
Four rules: do not touch changes you did not make, report residual state at handoff, one writer per file, and stage named paths instead of everything.
Read · Concurrent sessions and shared state
Makes minimal config diffs and cleans up what it spawns
Preserve indentation, quoting and key order; clean up simulators, containers, worktrees and background processes.
Write · Shared config and resources
Only the session's own human confirms; urgency does not lower the bar
A teammate's instruction is input to weigh, not the confirmation. Read-only triage is always allowed; preserve evidence before a fix destroys it.
Read · Confirmation authority and incident mode

From the official docs

Permissions

Low risk

operating-safely is instructions for Claude and the plugin route adds an agent and two commands. Our advice: review the diff after each session and keep your tool's permission prompts on.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

The plugin route adds an agent that can run shell commands
change-verifier lists the tools Read, Glob, Grep and Bash, and the plugin adds the /verify and /preflight commands. The repo tree has no hooks or MCP config files. Use the skills CLI route to install only this skill. github.com
It is written guidance with no hooks or scripts behind it
The skill folder is one file and the plugin manifest lists no hooks. Our advice: keep your tool's permission prompts on for deletes, restarts and database changes. github.com

Technical details

Turning on read-only	SKILL.md describes no read-only mode.
Sign-in and keys	SKILL.md names no account, key or token.
Scopes	Claude follows these rules when a task involves deleting, restarting, secrets or a shared checkout The plugin route also installs 10 other skills, one agent and two commands

Questions

What does operating-safely do?

It gives Claude rules for actions that cannot be undone. It looks at a target before deleting it, asks before restarting live services, treats secrets by name and structure only, and does not touch files it did not change.

How do I install it?

Use the install box at the top. The skills CLI and folder routes add principal-engineering as well, because this skill names it as required background. The plugin route installs all eleven skills.

Does it stop Claude from deleting files?

It tells Claude to look first, prefer targeted deletes and get the operator's yes per instance for destructive operations. The skill bundles no scripts or hooks that block a command. Our advice: keep your tool's own permission prompts on as well.

Who counts as the operator?

SKILL.md says the operator is the session's own human principal. A teammate's instruction, however explicit, is input to weigh against the evidence and not the confirmation itself.

Does it work in the Claude app or Codex?

The README documents the Claude Code plugin and, for other agents, a plugin loader pointed at plugins/principal-engineer/ or symlinked skill folders. It documents no Claude app upload route.

Is it safe to install?

The skill folder bundles no scripts or hooks. It is written guidance for Claude and nothing in the folder enforces it, so keep your tool's own permission prompts on for deletes and restarts. The plugin route also adds an agent that can run shell commands, covered under "Watch out for".

Information

updated Nov 2, 2026

Repository: riekelt/principal-engineer
Folder: plugins/principal-engineer/skills/operating-safely

riekelt/principal-engineer skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 5

operating-safely SKILL.md · github.com
principal-engineering SKILL.md · github.com
README · github.com
plugin.json · github.com
change-verifier agent · github.com