Stats
Actions
Tags
From claude-guard
This skill should be used when a command is blocked by claude-guard, when the response contains "BLOCKED by claude-guard", when the user asks "why was my command blocked", "what commands are blocked", "guard rules", "safety rules", or when Claude is about to execute a potentially dangerous command. Covers git force push, git reset --hard, git checkout --, git clean, git commit --no-verify, rm -rf, chmod 777, DROP TABLE, TRUNCATE, DELETE without WHERE, docker system prune, docker compose down -v, kubectl delete, kubectl drain, terraform destroy, terraform apply -auto-approve, aws s3 rm, gh repo delete, find -delete, git history rewrites, crontab -r, systemctl stop, helm uninstall, pip install from a URL, Route53 delete, and credential exposure warnings after file writes.
How this skill is triggered — by the user, by Claude, or both
Slash command
/claude-guard:guard-rulesThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
The claude-guard plugin enforces a three-tier safety model that prevents destructive operations before they execute and warns about credential exposure after file writes. Understanding these tiers enables working effectively within the safety boundaries and selecting safe alternatives without triggering blocks.
The claude-guard plugin enforces a three-tier safety model that prevents destructive operations before they execute and warns about credential exposure after file writes. Understanding these tiers enables working effectively within the safety boundaries and selecting safe alternatives without triggering blocks.
Catastrophic, irreversible commands that must never be executed by an AI agent. When a command is blocked at this tier, inform the user that the command must be run manually if truly needed. Do not attempt to find workarounds or alternative phrasings.
Categories:
rm -rf /, rm -rf ~, rm -rf $HOMEdd writing to block devices, mkfs, fdiskDROP DATABASE, DROP SCHEMAkubectl delete namespace, kubectl delete --allaws s3 rb --force, aws ec2 terminate-instances, aws rds delete-db-instance, aws rds delete-db-clustergcloud projects deletegh repo deleteaws route53 delete-hosted-zoneDangerous commands that have a safer alternative. The user is prompted for confirmation before execution. If the user approves, the command proceeds. If denied, suggest the safer alternative listed below.
Git Operations:
| Blocked Command | Safe Alternative |
|---|---|
git push --force / -f | git push --force-with-lease |
git reset --hard | git stash first, then reset |
git reset --merge | git stash first, then reset |
git checkout -- . or git checkout -- <path> | git stash or git diff first |
git restore (not --staged) | git restore --staged or git stash |
git clean -f | git clean -n (dry run) first |
git branch -D | git branch -d (merge check) |
git stash drop/clear | git stash list first |
git commit --no-verify | Remove flag, fix hook failures |
git push --no-verify | Remove flag, fix hook failures |
git checkout . / git checkout <path> | git stash or git diff first |
git filter-branch, git reflog expire, git gc --prune=now | Irreversible history rewrite/prune — confirm intent |
git update-ref -d, git push --mirror | Deletes/overwrites refs — confirm scope first |
Filesystem Operations:
| Blocked Command | Safe Alternative |
|---|---|
rm -rf <directory> (also rm -r -f, rm --recursive --force) | List contents first, ask user to confirm |
mv <path> /dev/null | Use rm with confirmation, or move to backup location |
chmod 777 | Use specific permissions (755, 644) |
find ... -delete / find ... -exec rm | Run the find without -delete first to review |
shred <file> | Use rm if recoverability is acceptable |
Process, Service & Scheduler:
| Blocked Command | Safe Alternative |
|---|---|
crontab -r | crontab -l first; back up before removing |
kill -1 / kill -9 -1 | Target a specific PID, not -1 |
systemctl stop / disable | Confirm service/env; systemctl status first |
chmod -R / chown -R on a system path | Scope the recursion to a project directory |
Docker Operations:
| Blocked Command | Safe Alternative |
|---|---|
docker system prune | docker system prune --dry-run first |
docker rm -f | docker stop then docker rm |
docker volume rm | docker volume ls first |
docker network rm | docker network ls first |
docker compose down -v | docker compose down (no -v) |
docker rmi -f | docker rmi without force |
Database Operations:
| Blocked Command | Safe Alternative |
|---|---|
DROP TABLE | Add IF EXISTS, confirm with user |
TRUNCATE | Use DELETE with WHERE clause |
DELETE FROM without WHERE | Add WHERE clause or confirm with user |
Kubernetes Operations:
| Blocked Command | Safe Alternative |
|---|---|
kubectl delete <resource> | kubectl delete --dry-run=client first |
kubectl drain <node> | Review affected pods first, confirm with user |
Cloud Operations (AWS/GCP/Azure):
| Blocked Command | Safe Alternative |
|---|---|
aws s3 rm --recursive | aws s3 rm --dryrun first |
gcloud compute instances delete | List instances first, confirm with user |
gcloud sql instances delete | Verify instance name, confirm with user |
gsutil rm -r | gsutil ls first |
az group delete | az group delete --dry-run first |
az vm delete | List VMs first, confirm with user |
az storage account delete | List storage first, confirm with user |
az sql server delete | Verify server name, confirm with user |
aws s3api delete-bucket | aws s3api list-objects first |
aws dynamodb delete-table | aws dynamodb describe-table first |
Infrastructure as Code:
| Blocked Command | Safe Alternative |
|---|---|
terraform destroy | terraform plan -destroy first |
terraform apply -destroy | terraform plan -destroy first |
pulumi destroy | pulumi preview --diff first |
cdk destroy | cdk diff first |
terraform apply -auto-approve | terraform plan, then apply without -auto-approve |
helm uninstall | helm list / helm get manifest first |
argocd app delete | argocd app get first |
flux delete | flux get all first |
GitHub CLI:
| Blocked Command | Safe Alternative |
|---|---|
gh release delete | gh release list first |
gh secret delete | gh secret list first |
gh extension install | Review the extension source before installing |
Supply Chain:
| Blocked Command | Safe Alternative |
|---|---|
pip install <url> / git+... | Install from PyPI by name, or vet the source first |
DNS Operations:
| Blocked Command | Safe Alternative |
|---|---|
aws route53 change-resource-record-sets (DELETE action) | List records first, confirm with user |
gcloud dns managed-zones delete | gcloud dns managed-zones list first |
az network dns zone delete | az network dns zone list first |
Detected after file writes. These do not block execution but add warning context. Review the warning and take corrective action if credentials were accidentally written.
Credential Patterns Detected:
Destructive SQL in Files:
DROP TABLE/DATABASE/SCHEMA/INDEX statementsTRUNCATE statementsDELETE FROM without WHERE clauseScan scope: Credential patterns are checked in all written files except .git/, .env.example, .env.template, .env.sample, node_modules/, and lock files (package-lock.json, yarn.lock, pnpm-lock.yaml, Podfile.lock, go.sum, Cargo.lock). Destructive SQL scanning only applies to .sql, .py, .js, .ts, .rb, .go, .java, .php, .sh, and .bash files.
The guard uses context-aware matching to avoid false positives. Patterns are only matched against executed code, not string data:
echo, printf, grep, sed, awk, git commit -m, etc. are treated as data and not matched--notes, --body, --title, -m, --message are treated as data (e.g., gh release create --notes "covers DROP TABLE" is safe)MSG="git push --force" is a variable assignment, not executed# is ignoredbash -c, eval, source — string arguments to these ARE matched because they will be executed... | bash, | bash -s, | sudo bash, | python3 (which read stdin as code) are blocked; piping data into a script file (cat data | python3 app.py) is allowedbash <(curl ...), source <(wget ...) — executes arbitrary remote codepython -c, ruby -e, perl -e, node -e with destructive patterns are blockedCommands are normalized before matching to prevent evasion:
/usr/bin/git becomes gitgit push --force becomes git push --forceenv wrappers stripped: env VAR=val git push --force becomes git push --forcegit -c config stripped: git -c user.name=x push --force becomes git push --forceThe guard splits commands on ;, &&, and || and evaluates each statement separately. An allowlisted statement (e.g. git clean -n) clears only itself — it cannot shield a dangerous one chained after it, so git clean -n && rm -rf / is still blocked. Tier 1 (catastrophic) patterns are matched against the whole command and can never be suppressed by the allowlist.
The following commands are always permitted, even if they partially match a blocked pattern:
git checkout -b (creating a new branch)git checkout --orphan (creating an orphan branch)git restore --staged / -S (unstaging files, not modifying working tree)git clean -n / --dry-run (previewing what would be removed)git push --force-with-lease / --force-if-includesrm -rf /tmp/*, /var/tmp/*, $TMPDIR/* (temp cleanup — only when the temp path is the sole target and contains no .. escape)docker system prune --dry-runkubectl delete --dry-runaws s3 rm --dryrun, aws ... --dry-run (AWS dry run)az ... --dry-run (Azure dry run)Before executing commands, verify they follow these patterns:
--force-with-lease instead of --forcels before using rm -rfgit clean -n)docker system prune --dry-run)WHERE clauses in DELETE statements--dryrun/--dry-run flags when availableplan or preview before destroyWhen writing files that handle configuration or authentication:
process.env.API_KEY, os.environ["SECRET"], ${VAR}).env.example files with placeholder values for documentationFor debugging false positives or understanding guard decisions, set CLAUDE_GUARD_EXPLAIN=1 in the environment. The guard will output its decision pipeline to stderr without affecting the JSON protocol on stdout.
For the authoritative and up-to-date list of all patterns, read the pack files directly:
$CLAUDE_PLUGIN_ROOT/hooks/scripts/guard/packs/core.py$CLAUDE_PLUGIN_ROOT/hooks/scripts/guard/packs/cloud.py$CLAUDE_PLUGIN_ROOT/hooks/scripts/guard/packs/infra.py$CLAUDE_PLUGIN_ROOT/hooks/scripts/guard/packs/cicd.py$CLAUDE_PLUGIN_ROOT/hooks/scripts/guard/packs/dns.py$CLAUDE_PLUGIN_ROOT/hooks/scripts/guard/packs/credentials.pyThe tables in this skill provide a quick reference, but the pack files are the definitive source if discrepancies arise.
Provides CDSS development patterns for drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), and alert classification integrated into EMR workflows.
npx claudepluginhub hex/claude-marketplace --plugin claude-guard