block-agent-workflow-edits

Blocks AI agent Write and Edit operations targeting GitHub Actions workflow files, requiring human review of CI/CD workflow changes.

enforce● PreToolUse● on by default● 1 pack installs

━━ when it runs

PreToolUsebefore the tool call runs. a denial here means the command never executes at all.

watchesevery tool the event fires for — not narrowed to particular tools

this pack enforces: a match returns a real denial rather than being recorded and discarded. what the denial then does depends on the event above.

this one is on by default — taking the pack without flags turns it on, and the picker shows it pre-ticked.