damage-control

Security hooks for Claude Code that check commands and file changes before they run. They can block access to sensitive paths such as .env files and credentials, or protect files from deletion.

In plain words
What is it for?
Use it to install and manage protections for shell commands, file edits, and new files. It covers actions such as deleting files, discarding Git changes, and running certain SQL deletes.
Why use it?
They reduce the chance that an automated coding session runs a destructive command or changes an important file by mistake. Some risky actions can require confirmation instead of being blocked outright.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/cfircoo/claude-code-toolkit/damage-control
Any agent
npx skills add cfircoo/claude-code-toolkit --skill damage-control
Clone the repo
git clone --depth 1 https://github.com/cfircoo/claude-code-toolkit

Made for: Claude Code, Codex.

Per session 57 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,541 The whole file, excluding the scripts and references it only reads on demand.
Security scan C 5 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00057 $0.01541
Opus 5 $0.00028 $0.00771
Sonnet 5 $0.00011 $0.00308
Haiku 4.5 $0.00006 $0.00154

Measured 2d ago against content hash 538625b9e8d4, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade C, and why

damage-control scanned grade C with 5 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

The scan reads SKILL.md. This mod also ships 5 executable files (scripts/bash-tool-damage-control.py, scripts/edit-tool-damage-control.py, scripts/read-tool-damage-control.py, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootlowPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

- `rm -rf`, `rm --recursive`, `sudo rm`

Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.

Downloads and executes remote codemediumSupply chain

curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.

curl -LsSf https://astral.sh/uv/install.sh | sh

Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.

Reads agent configuration directorieslowAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

| Global | `~/.claude/settings.json` | `~/.claude/hooks/damage-control/` | All projects |

Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.

Recursive force deletemediumDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

description: Install, configure, and manage Claude Code security hooks that block dangerous commands and protect sensitive files. Use when setting up security protection, blocking destructive commands (rm -rf, git reset

Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -LsSf https://astral.sh/uv/install.sh | sh
skills/damage-control/SKILL.md · 164 lines

How it starts

The opening of the file, as written. The whole thing — 164 lines — stays where its author put it; the contents beside it link to each section on GitHub.

<protection_levels>

Level Read Write Edit Delete Use Case
zeroAccessPaths No No No No Secrets, credentials, .env files
readOnlyPaths Yes No No No System configs, lock files, build artifacts
noDeletePaths Yes Yes Yes No Important project files, .git/, LICENSE
</protection_levels>

<how_it_works> PreToolUse hooks intercept tool calls at three points:

  1. Bash Hook - Evaluates commands against regex patterns and path restrictions
  2. Edit Hook - Validates file paths before modifications
  3. Write Hook - Checks paths before file creation

Exit codes:

  • 0 = Allow operation
  • 0 + JSON = Ask for confirmation (triggers dialog)
  • 2 = Block operation (stderr fed back to Claude)

Ask patterns: Some operations trigger confirmation dialogs instead of blocking:

  • git checkout -- . (discards changes)
  • git stash drop (deletes stash)
  • DELETE FROM table WHERE id=X (SQL with specific ID) </how_it_works>

<quick_start> Interactive installation:

/damage-control install

Or ask Claude:

"Install damage control security hooks" "Set up protection for my project" </quick_start>

  1. Install - Set up damage control hooks (global, project, or personal)
  2. Modify - Add/remove protected paths or blocked commands
  3. Test - Validate hooks are working correctly
  4. List - View all active protections across all levels

Wait for response before proceeding.

Direct command routing (skip menu):

  • "add ~/.credentials to zero access" → Execute directly, then restart reminder
  • "block npm publish command" → Execute directly, then restart reminder
  • "protect /secrets folder" → Execute directly, then restart reminder

After reading the workflow, follow it exactly.

<blocked_commands_summary> Destructive file operations:

  • rm -rf, rm --recursive, sudo rm
  • chmod 777, chown -R root

Git destructive:

  • git reset --hard, git push --force (not --force-with-lease)
  • git clean -fd, git stash clear, git filter-branch

Cloud destructive:

  • AWS: terminate-instances, delete-db-instance, delete-stack
  • GCP: projects delete, instances delete, clusters delete
  • Docker: system prune -a, volume rm
  • Kubernetes: delete namespace, delete all --all

Database destructive:

  • DELETE FROM table; (no WHERE clause)
  • DROP TABLE, DROP DATABASE, TRUNCATE TABLE
  • redis-cli FLUSHALL, dropdb

See scripts/patterns.yaml for complete list. </blocked_commands_summary>

<settings_locations>

Level Settings Path Hooks Path Scope
Global ~/.claude/settings.json ~/.claude/hooks/damage-control/ All projects
Project .claude/settings.json .claude/hooks/damage-control/ Team-shared
Personal .claude/settings.local.json .claude/hooks/damage-control/ Just you
</settings_locations>

<runtime_requirements> Python with UV (Recommended):

# macOS/Linux
curl -LsSf https://astral.sh/uv/install.sh | sh

# Windows
powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"

TypeScript with Bun (Alternative):

# macOS/Linux
curl -fsSL https://bun.sh/install | bash && bun add yaml

# Windows
powershell -c "irm bun.sh/install.ps1 | iex" && bun add yaml

</runtime_requirements>

Read the full file on GitHub · 164 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 164 lines · 57 tokens per session scan C 538625b9e8d4

Subscribe to this mod's changes

damage-control is a skill published in the GitHub repository cfircoo/claude-code-toolkit (17 stars, last pushed 5mo ago), licensed MIT. It adds 57 tokens to every session and 1,541 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 5 findings (asks for root, downloads and executes remote code, reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

systematic-debugging

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.

obra/superpowers · 21 tokens

chat-pet-sprite-creation

Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.

microsoft/vscode · 53 tokens

cpu-profile-analysis

Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…

microsoft/vscode · 71 tokens

babysit-pr

Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropriate, and keep…

openai/codex · 114 tokens

imagegen

Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output…

openai/codex · 113 tokens

agent-host-chat-contributions

Build and review cross-cutting agent-host chat behavior through lifecycle contributions. Use when adding turn lifecycle side effects, prompt or context injection, restored-history transformation, protocol-action observation, or when reviewing changes that add code to AgentSideEffects or AgentService.

microsoft/vscode · 56 tokens