careful, block destructive commands for this session
Invoking this skill registers a PreToolUse hook on Bash (the hooks: block above).
Claude Code keeps a skill's hooks registered for the rest of the session, on every
later turn, so careful stays on until the session ends. There is no off switch:
start a new session to work without it.
What it blocks
| Rule | Blocks | Still allowed |
|---|---|---|
rm-rf | rm with recursive and force flags (-rf, -fr, -r -f, --recursive --force), xargs rm -rf, and any target the shell expands: $TMPDIR/x, $TMP, $TEMP, $X, $( ), globs, braces, ~ | the same command when every target is a LITERAL absolute path that lands, after following existing symlinks, strictly inside /tmp, /private/tmp or the configured TMPDIR (trusted only when it is two or more levels deep); write /tmp/build, not $TMPDIR/build, because a command can reassign TMPDIR first (TMPDIR=/ ; rm -rf $TMPDIR/usr); rm -r; rm -f file |
git-push-force | git push --force, -f (also inside -uf), --force-with-lease[=...], a +branch refspec, to any branch | git push, git push -u origin <branch> |
git-push-delete | git push origin --delete <b>, -d <b>, :<b> | git push origin <b>:<b> |
git-reset-hard | git reset --hard | git reset --soft, git reset HEAD <file> |
sql-drop | DROP TABLE, DROP DATABASE, DROP SCHEMA anywhere in the command, heredocs included | a SELECT that mentions drop |
sql-truncate | TRUNCATE TABLE, or a TRUNCATE <name> statement sent to a SQL client | truncate -s 0 file.log |
kubectl-delete | kubectl ... delete | kubectl get, kubectl logs |
terraform-destroy | terraform destroy, terraform apply -destroy, the same with tofu | terraform plan, terraform apply |
Matching is on shell words, not substrings: a commit message or grep pattern that
quotes git push --force is text, not a push. Compound commands are split on
;, &&, | and newlines, and the bodies of bash -c, eval, $( ) and the
remote command of ssh host '...' are checked as well.
When a command is blocked
The hook exits 2 and Claude sees the reason, for example:
[ork:careful] blocked by rule git-push-force: git push with --force-with-lease. careful mode is on for this session, so destructive commands do not run unattended. To proceed, ask the operator: they can run the command themselves, or confirm it and run it outside careful mode.
Then stop and ask. Do not rewrite the command to slip past the matcher (a different flag spelling, a script file, an alias): the operator turned careful on to be asked, and a workaround defeats that even when the matcher misses it.
Limits
careful is a pattern matcher on the text of each Bash call. It is a seatbelt, not a sandbox. It does NOT see:
-
shell aliases and functions (
alias nuke='rm -rf', thennuke src); -
scripts, Makefiles, npm scripts or binaries that run these commands inside (
./deploy.sh,make clean,npm run reset-db); -
evalorbash -cbuilt from variables, base64 or other indirection it cannot read as text; it only reads literal strings; -
interpreters and other shells running the same thing (
python -c "shutil.rmtree(...)",node -e,fish -c,pwsh), or a remote shell other than plainssh host '...'; -
a link created in the same command (
ln -s / /tmp/r9 && rm -rf /tmp/r9/usr): the guard follows links that already exist when it runs (a temp path through a link to/usris denied), but one made by the command itself is out of reach for a text check, likepython -c "shutil.rmtree(...)"; -
MCP tools, file edits, and anything outside the Bash tool.
-
If the hook cannot read its input it blocks (exit 2) rather than guess.
-
To also fence file edits to one directory, use the freeze skill.
The guard is scripts/careful-guard.mjs (Node, no dependencies); its matcher
cases live in tests/unit/test-careful-guard.mjs.
