<!-- AUTO-GENERATED from SKILL.md.tmpl — do not edit directly -->
<!-- Regenerate: bun run gen:skill-docs -->
When to invoke this skill
Warns before rm -rf, DROP TABLE,
force-push, git reset --hard, kubectl delete, and similar destructive operations.
User can override each warning. Use when touching prod, debugging live systems,
or working in a shared environment. Use when asked to "be careful", "safety mode",
"prod mode", or "careful mode".
/careful — Destructive Command Guardrails
Safety mode is now active. Every Bash and PowerShell command will be checked
for destructive patterns before running. If a destructive command is detected, you'll be warned
and can choose to proceed or cancel.
GSTACK_STATE_ROOT=$(~/.claude/skills/gstack/bin/gstack-paths --get GSTACK_STATE_ROOT); : "${GSTACK_STATE_ROOT:?gstack-paths failed; reinstall with ./setup or /gstack-upgrade}"
mkdir -p "$GSTACK_STATE_ROOT"/analytics
echo '{"skill":"careful","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'","repo":"'$(basename "$(git rev-parse --show-toplevel 2>/dev/null)" 2>/dev/null || echo "unknown")'"}' >> "$GSTACK_STATE_ROOT"/analytics/skill-usage.jsonl 2>/dev/null || true
What's protected
| Pattern | Example | Risk |
|---|
rm -rf / rm -r / rm --recursive | rm -rf /var/data | Recursive delete |
DROP TABLE / DROP DATABASE | DROP TABLE users; | Data loss |
TRUNCATE | TRUNCATE orders; | Data loss |
git push --force / -f | git push -f origin main | History rewrite |
git reset --hard | git reset --hard HEAD~3 | Uncommitted work loss |
git checkout . / git restore . | git checkout . | Uncommitted work loss |
kubectl delete | kubectl delete pod | Production impact |
docker rm -f / docker system prune | docker system prune -a | Container/image loss |
PowerShell and cmd (Windows)
The hook also checks the PowerShell tool (Claude Code's main Windows shell)
and any pwsh/powershell/cmd launched from Bash. Matching ignores case,
covers aliases in command position, accepts parameter prefixes (-r, -fo)
and strips cmd ^ escapes. All rows above apply there too.
| Pattern | Example |
|---|
Remove-Item/rm/ri/del/erase/rd/rmdir + -Recurse or -Force | gci | ri -r -fo |
cmd rd /s, rmdir /s, del /s, erase /s | cmd /c rd /s /q C:\proj |
Format-Volume, Clear-Disk, Clear-Content, [IO.Directory]::Delete, [IO.File]::Delete | Clear-Disk -Number 1 |
-EncodedCommand, iex, Start-Process of a shell, & $cmd (can't be inspected) | irm $url | iex |
Best-effort on PowerShell. String matching can't see a command built at
runtime. For a hard stop, add Claude Code permission deny rules, which parse
PowerShell and its aliases: "deny": ["PowerShell(Remove-Item *)"] in
.claude/settings.json. The hook runs through bash, so Windows needs Git Bash.
Safe exceptions
These patterns are allowed without warning:
rm -rf node_modules / .next / dist / __pycache__ / .cache / build / .turbo / coverage
How it works
The hook reads tool_name and the command from the tool input JSON, checks it against the
patterns above, and returns a hookSpecificOutput payload with
permissionDecision: "ask" and a warning reason if a match is found (the
decision must be nested under hookSpecificOutput — Claude Code ignores a
top-level permissionDecision). You can always override a MEDIUM warning and
proceed.
HIGH tier (hard deny)
Two catastrophic shapes are denied, not asked: rm -r/-R of exactly
/, ~, or $HOME, and force-push to the repo's default branch. SIMPLE
commands only (no ;, &&, ||, |, newline) — compound shapes fall
through to the MEDIUM ask; --force-with-lease is never HIGH. A best-effort
advisory hard-stop, not a policy boundary: the escape hatch is ending the
opt-in, session-scoped /careful session.
Project patterns (additive only)
Add warn rules — one POSIX ERE per line, # comments OK — in
~/.gstack/careful-patterns.txt (global) or
~/.gstack/projects/<slug>/careful-patterns.txt (per-project). Consulted
after the built-in families, so config can only ADD rules, never suppress a
baseline warning. Invalid regex lines are skipped.
To deactivate, end the conversation or start a new one. Hooks are session-scoped.