command-guard

command-guard — Block Dangerous Commands Before They Execute

Claude Code runs shell commands, edits files, and manages infrastructure with real consequences. Without guardrails, a misunderstood instruction or a hallucinated flag can delete data, corrupt history, or expose credentials. This skill installs a PreToolUse hook that blocks the most dangerous operations before they run.

No external tools required — this uses Claude Code's built-in hook system.

---

What Gets Blocked

The guard intercepts Bash tool calls and checks the command against a blocklist before execution. By default it blocks:

Irreversible deletions

• rm -rf on non-temporary paths
• git clean -f (untracked file deletion)

Git history destruction

• git push --force / git push -f (without explicit user confirmation)
• git reset --hard on shared branches
• git rebase on pushed branches

Database operations

• DROP TABLE, DROP DATABASE, TRUNCATE in SQL
• db:reset, db:drop npm/prisma scripts

Credential exposure

• Commands that cat, echo, or curl files containing SECRET, KEY, TOKEN, PASSWORD to stdout

---

Installation

Step 1: Create the hook script

mkdir -p .claude/hooks

Create .claude/hooks/command-guard.py:

#!/usr/bin/env python3
"""
command-guard.py — PreToolUse hook that blocks dangerous Bash commands.
Claude Code calls this before executing any Bash tool call.
Exit code 2 = block the command and show the message.
Exit code 0 = allow the command.
"""
import sys
import json
import re
import os

# Load the tool call input from stdin
try:
    payload = json.load(sys.stdin)
except Exception:
    sys.exit(0)  # Can't parse — allow (fail open)

tool_name = payload.get('tool_name', '')
tool_input = payload.get('tool_input', {})

# Only intercept Bash calls
if tool_name != 'Bash':
    sys.exit(0)

command = tool_input.get('command', '')

# --- Blocklist rules ---
# Each rule: (regex pattern, reason shown to agent)

BLOCKED = [
    # Irreversible deletions
    (r'\brm\s+-[a-zA-Z]*r[a-zA-Z]*f\b', 'rm -rf is blocked. Use rm with explicit paths, or move to trash instead.'),
    (r'\bgit\s+clean\s+-[a-zA-Z]*f\b', 'git clean -f is blocked. List untracked files with --dry-run first.'),

    # Force push
    (r'\bgit\s+push\s+.*--force\b', 'Force push is blocked. Confirm with the user before rewriting remote history.'),
    (r'\bgit\s+push\s+.*-f\b(?!ile)', 'Force push (-f) is blocked. Confirm with the user before rewriting remote history.'),

    # Hard reset
    (r'\bgit\s+reset\s+--hard\b', 'git reset --hard is blocked. Use --soft or --mixed, or confirm with user first.'),

    # Database destructive ops
    (r'\b(DROP\s+(TABLE|DATABASE|SCHEMA)|TRUNCATE\s+TABLE)\b', 'Destructive SQL (DROP/TRUNCATE) is blocked. Confirm with the user before destroying data.', re.IGNORECASE),
    (r'\b(db:reset|db:drop|prisma.*reset)\b', 'Database reset scripts are blocked. Confirm with the user — this destroys all data.'),

    # Credential leakage to stdout (basic check)
    (r'\b(cat|echo|curl|printf)\b.*\.(env|secret|secrets|pem|key)\b', 'Printing credential files to stdout is blocked. Use secure variable injection instead.'),
]

for rule in BLOCKED:
    pattern = rule[0]
    message = rule[1]
    flags = rule[2] if len(rule) > 2 else 0
    if re.search(pattern, command, flags):
        print(json.dumps({
            "decision": "block",
            "reason": f"[command-guard] {message}\n\nBlocked command: {command[:200]}"
        }))
        sys.exit(2)

# All clear
sys.exit(0)