← LeaderboardThe Skill Leaderboard

careful

Safety guardrails for destructive commands. (gstack)

Published by garrytan ↗garrytan/gstack

Try your first task

careful

Start a fresh conversation.

Use careful to activate destructive-command guardrails for this conversation so covered Bash and PowerShell commands require my approval before proceeding, preserving the documented safe exceptions and hard denials. Explain the protection’s limits and how to end the session-scoped protection.

Suggested template by Skill Leaderboard, grounded in the linked source. Task evidence ↗

SKILL.md

name: carefulversion: 0.1.0description: Safety guardrails for destructive commands. (gstack)triggers:   - be careful  - warn before destructive  - safety modeallowed-tools:   - Bash  - Readhooks:   PreToolUse:     - matcher: "Bash"      hooks:         - type: command          command: 'bash -c "exec bash \"$HOME/.claude/skills/gstack/careful/bin/check-careful.sh\""'          statusMessage: "Checking for destructive commands..."    - matcher: "PowerShell"      hooks:         - type: command          command: 'bash -c "exec bash \"$HOME/.claude/skills/gstack/careful/bin/check-careful.sh\""'          statusMessage: "Checking for destructive commands..."

/careful — Destructive Command Guardrails

Safety mode is now active. Every Bash and PowerShell command will be checked for destructive patterns before running. If a destructive command is detected, you'll be warned and can choose to proceed or cancel.

GSTACK_STATE_ROOT=$(~/.claude/skills/gstack/bin/gstack-paths --get GSTACK_STATE_ROOT); : "${GSTACK_STATE_ROOT:?gstack-paths failed; reinstall with ./setup or /gstack-upgrade}"
mkdir -p "$GSTACK_STATE_ROOT"/analytics
echo '{"skill":"careful","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'","repo":"'$(basename "$(git rev-parse --show-toplevel 2>/dev/null)" 2>/dev/null || echo "unknown")'"}'  >> "$GSTACK_STATE_ROOT"/analytics/skill-usage.jsonl 2>/dev/null || true

What's protected

Pattern	Example	Risk
`rm -rf` / `rm -r` / `rm --recursive`	`rm -rf /var/data`	Recursive delete
`DROP TABLE` / `DROP DATABASE`	`DROP TABLE users;`	Data loss
`TRUNCATE`	`TRUNCATE orders;`	Data loss
`git push --force` / `-f`	`git push -f origin main`	History rewrite
`git reset --hard`	`git reset --hard HEAD~3`	Uncommitted work loss
`git checkout .` / `git restore .`	`git checkout .`	Uncommitted work loss
`kubectl delete`	`kubectl delete pod`	Production impact
`docker rm -f` / `docker system prune`	`docker system prune -a`	Container/image loss

PowerShell and cmd (Windows)

The hook also checks the PowerShell tool (Claude Code's main Windows shell) and any pwsh/powershell/cmd launched from Bash. Matching ignores case, covers aliases in command position, accepts parameter prefixes (-r, -fo) and strips cmd ^ escapes. All rows above apply there too.

Pattern	Example
`Remove-Item`/`rm`/`ri`/`del`/`erase`/`rd`/`rmdir` + `-Recurse` or `-Force`	`gci \| ri -r -fo`
cmd `rd /s`, `rmdir /s`, `del /s`, `erase /s`	`cmd /c rd /s /q C:\proj`
`Format-Volume`, `Clear-Disk`, `Clear-Content`, `[IO.Directory]::Delete`, `[IO.File]::Delete`	`Clear-Disk -Number 1`
`-EncodedCommand`, `iex`, `Start-Process` of a shell, `& $cmd` (can't be inspected)	`irm $url \| iex`

Best-effort on PowerShell. String matching can't see a command built at runtime. For a hard stop, add Claude Code permission deny rules, which parse PowerShell and its aliases: "deny": ["PowerShell(Remove-Item *)"] in .claude/settings.json. The hook runs through bash, so Windows needs Git Bash.

Safe exceptions

These patterns are allowed without warning:

rm -rf node_modules / .next / dist / __pycache__ / .cache / build / .turbo / coverage

How it works

The hook reads tool_name and the command from the tool input JSON, checks it against the patterns above, and returns a hookSpecificOutput payload with permissionDecision: "ask" and a warning reason if a match is found (the decision must be nested under hookSpecificOutput — Claude Code ignores a top-level permissionDecision). You can always override a MEDIUM warning and proceed.

HIGH tier (hard deny)

Two catastrophic shapes are denied, not asked: rm -r/-R of exactly /, ~, or $HOME, and force-push to the repo's default branch. SIMPLE commands only (no ;, &&, ||, |, newline) — compound shapes fall through to the MEDIUM ask; --force-with-lease is never HIGH. A best-effort advisory hard-stop, not a policy boundary: the escape hatch is ending the opt-in, session-scoped /careful session.

Project patterns (additive only)

Add warn rules — one POSIX ERE per line, # comments OK — in ~/.gstack/careful-patterns.txt (global) or ~/.gstack/projects/<slug>/careful-patterns.txt (per-project). Consulted after the built-in families, so config can only ADD rules, never suppress a baseline warning. Invalid regex lines are skipped.

To deactivate, end the conversation or start a new one. Hooks are session-scoped.