careful
The facts
Its description
Safety guardrails for destructive commands. (gstack) Triggers: be careful; warn before destructive; safety mode
The description the agent reads to decide when to use it. Phrases the author says should start it.
When it starts
The agent picks this skill when the person asks it to be careful about destructive commands, to warn before running anything dangerous, or to turn on a safety mode for the session. It is a session-scoped guardrail that hooks every Bash and PowerShell command.
Things a person might say (the model's guesses)
- “be careful with destructive commands from here on”
- “warn me before you run anything destructive”
- “turn on safety mode for this session”
A model's summary of when it is used.
Tools it may use, or may not
allowed-tools: Bash, Read
Tools it may use while it runs without asking you first.
Runs scripts
bin/gstack-paths
Scripts the text names. Found by matching words, so treat them as pointers.
Runs automatically at certain moments
Runs commands automatically at set moments
Hooks run commands at moments such as before a tool is used. The linked line shows them as written.
What leads to it
- gstack hands off to this PROACTIVE all, or user names it gstack, line 222
- guard calls this guard, line 47
Other skills that hand off to this one, call it, require it or offer it instead, as a model read them.
Licence
MIT, from LICENSE
The terms its author shares it under, which let it be shown here.
Other settings
version: 0.1.0
More settings at the top of the file, shown as written.
Other files in this skill (2) Close
The text
Most marks come from matching words in the file, so treat them as pointers.
<!-- AUTO-GENERATED from SKILL.md.tmpl — do not edit directly --> <!-- Regenerate: bun run gen:skill-docs -->
/careful — Destructive Command Guardrails
Safety mode is now active. Every Bash and PowerShell command will be checked for destructive patterns before running. If a destructive command is detected, you'll be warned and can choose to proceed or cancel.
GSTACK_STATE_ROOT=$(~/.claude/skills/gstack/bin/gstack-paths --get GSTACK_STATE_ROOT); : "${GSTACK_STATE_ROOT:?gstack-paths failed; reinstall with ./setup or /gstack-upgrade}"
mkdir -p "$GSTACK_STATE_ROOT"/analytics
echo '{"skill":"careful","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'","repo":"'$(basename "$(git rev-parse --show-toplevel 2>/dev/null)" 2>/dev/null || echo "unknown")'"}' >> "$GSTACK_STATE_ROOT"/analytics/skill-usage.jsonl 2>/dev/null || trueWhat's protected
| Pattern | Example | Risk |
|---|---|---|
rm -rf / rm -r / rm --recursive | rm -rf /var/data | Recursive delete |
DROP TABLE / DROP DATABASE | DROP TABLE users; | Data loss |
TRUNCATE | TRUNCATE orders; | Data loss |
git push --force / -f | git push -f origin main | History rewrite |
git reset --hard | git reset --hard HEAD~3 | Uncommitted work loss |
git checkout . / git restore . | git checkout . | Uncommitted work loss |
kubectl delete | kubectl delete pod | Production impact |
docker rm -f / docker system prune | docker system prune -a | Container/image loss |
PowerShell and cmd (Windows)
The hook also checks the PowerShell tool (Claude Code's main Windows shell) and any pwsh/powershell/cmd launched from Bash. Matching ignores case, covers aliases in command position, accepts parameter prefixes (-r, -fo) and strips cmd ^ escapes. All rows above apply there too.
| Pattern | Example | |
|---|---|---|
Remove-Item/rm/ri/del/erase/rd/rmdir + -Recurse or -Force | `gci \ | ri -r -fo` |
cmd rd /s, rmdir /s, del /s, erase /s | cmd /c rd /s /q C:\proj | |
Format-Volume, Clear-Disk, Clear-Content, [IO.Directory]::Delete, [IO.File]::Delete | Clear-Disk -Number 1 | |
-EncodedCommand, iex, Start-Process of a shell, & $cmd (can't be inspected) | `irm $url \ | iex` |
Best-effort on PowerShell. String matching can't see a command built at runtime. For a hard stop, add Claude Code permission deny rules, which parse PowerShell and its aliases: "deny": ["PowerShell(Remove-Item *)"] in .claude/settings.json. The hook runs through bash, so Windows needs Git Bash.
Safe exceptions
These patterns are allowed without warning:
rm -rf node_modules/.next/dist/__pycache__/.cache/build/.turbo/coverage
How it works
The hook reads tool_name and the command from the tool input JSON, checks it against the patterns above, and returns a hookSpecificOutput payload with permissionDecision: "ask" and a warning reason if a match is found (the decision must be nested under hookSpecificOutput — Claude Code ignores a top-level permissionDecision). You can always override a MEDIUM warning and proceed.
HIGH tier (hard deny)
Two catastrophic shapes are denied, not asked: rm -r/-R of exactly /, ~, or $HOME, and force-push to the repo's default branch. SIMPLE commands only (no ;, &&, ||, |, newline) — compound shapes fall through to the MEDIUM ask; --force-with-lease is never HIGH. A best-effort advisory hard-stop, not a policy boundary: the escape hatch is ending the opt-in, session-scoped /careful session.
Project patterns (additive only)
Add warn rules — one POSIX ERE per line, # comments OK — in ~/.gstack/careful-patterns.txt (global) or ~/.gstack/projects/<slug>/careful-patterns.txt (per-project). Consulted after the built-in families, so config can only ADD rules, never suppress a baseline warning. Invalid regex lines are skipped.
To deactivate, end the conversation or start a new one. Hooks are session-scoped.
Raw lines 95 to 103From garrytan/gstack at 3f79d81, 2026-11-01. Skills read by DeepSeek V4.1 Flash on 2026-11-04. Summary and techniques by Claude Opus 5.5 on 2026-11-06.