careful

name careful version 0.1.0 description Safety guardrails for destructive commands. (gstack) triggers ["be careful","warn before destructive","safety mode"] allowed-tools ["Bash","Read"] hooks {"PreToolUse":[{"matcher":"Bash","hooks":"[Truncated]"}]} When to invoke this skill Warns before rm -rf, DROP TABLE, force-push, git reset --hard, kubectl delete, and similar destructive operations. User can override each warning. Use when touching prod, debugging live systems, or working in a shared environment. Use when asked to "be careful", "safety mode", "prod mode", or "careful mode". /careful — Destructive Command Guardrails Safety mode is now active . Every bash command will be checked for destructive patterns before running. If a destructive command is detected, you'll be warned and can choose to proceed or cancel. mkdir -p ~/.gstack/analytics echo '{"skill":"careful","ts":"' $( date -u +%Y-%m-%dT%H:%M:%SZ) '","repo":"' $( basename " $(git rev-parse --show-toplevel 2>/dev/null) " 2>/dev/null || echo "unknown" ) '"}' >> ~/.gstack/analytics/skill-usage.jsonl 2>/dev/null || true What's protected Pattern Example Risk rm -rf / rm -r / rm --recursive rm -rf /var/data Recursive delete DROP TABLE / DROP DATABASE DROP TABLE users; Data loss TRUNCATE TRUNCATE orders; Data loss git push --force / -f git push -f origin main History rewrite git reset --hard git reset --hard HEAD~3 Uncommitted work loss git checkout . / git restore . git checkout . Uncommitted work loss kubectl delete kubectl delete pod Production impact docker rm -f / docker system prune docker system prune -a Container/image loss Safe exceptions These patterns are allowed without warning: rm -rf node_modules / .next / dist / __pycache__ / .cache / build / .turbo / coverage How it works The hook reads the command from the tool input JSON, checks it against the patterns above, and returns a hookSpecificOutput payload with permissionDecision: "ask" and a warning reason if a match is found (the decision must be nested under hookSpecificOutput — Claude Code ignores a top-level permissionDecision ). You can always override a MEDIUM warning and proceed. HIGH tier (hard deny) Two catastrophic shapes are denied , not asked: rm -r / -R of exactly / , ~ , or $HOME , and force-push to the repo's default branch . SIMPLE commands only (no ; , && , || , | , newline) — compound shapes fall through to the MEDIUM ask; --force-with-lease is never HIGH. A best-effort advisory hard-stop, not a policy boundary: the escape hatch is ending the opt-in, session-scoped /careful session. Project patterns (additive only) Add warn rules — one POSIX ERE per line, # comments OK — in ~/.gstack/careful-patterns.txt (global) or ~/.gstack/projects/<slug>/careful-patterns.txt (per-project). Consulted after the built-in families, so config can only ADD rules, never suppress a baseline warning. Invalid regex lines are skipped. To deactivate, end the conversation or start a new one. Hooks are session-scoped.