Now liveThe Skillselion MCP - thousands of ranked skills, loaded into your agent mid-task. No install.Get it →
dicklesworthstone avatar

Dcg

dicklesworthstone/destructive_command_guard

  • 169 installs
  • 5.6k repo stars
  • Updated August 4, 2026
  • dicklesworthstone/destructive_command_guard

Intercept or block rm -rf, force pushes, credential wipes, and other irreversible shell commands before an agent or developer executes them in local or CI environments.

About

The destructive_command_guard (dcg) skill from dicklesworthstone/destructive_command_guard teaches Claude Code to recognize and refuse dangerous terminal commands. It acts as an appsec safety layer for agentic and CLI workflows where a single mistyped rm or force push could destroy data.

  • Blocks high-risk destructive shell patterns
  • Protects repos during agent-driven command runs
  • Reduces accidental data loss and credential exposure
  • Lightweight guard for CLI and coding agents
  • Pairs with automated dev workflows safely

Dcg by the numbers

  • 169 all-time installs (skills.sh)
  • Ranked #842 of 2,203 Security skills by installs in the Skillselion catalog
  • Data as of Aug 5, 2026 (Skillselion catalog sync)
npx skills add https://github.com/dicklesworthstone/destructive_command_guard --skill dcg

Add your badge

Show developers this skill is listed on Skillselion. Paste this into your README.

Listed on Skillselion
Installs169
repo stars★ 5.6k
Last updatedAugust 4, 2026
Repositorydicklesworthstone/destructive_command_guard ↗

What it does

Intercept or block rm -rf, force pushes, credential wipes, and other irreversible shell commands before an agent or developer executes them in local or CI environments.

Files

SKILL.mdMarkdownGitHub ↗

DCG — Destructive Command Guard

A high-performance Claude Code hook that intercepts and blocks destructive commands before they execute. Written in Rust with SIMD-accelerated filtering for sub-millisecond latency.

Why This Exists

AI coding agents are powerful but fallible. They can accidentally run destructive commands:

  • "Let me clean up the build artifacts" → rm -rf ./src (typo)
  • "I'll reset to the last commit" → git reset --hard (destroys uncommitted changes)
  • "Let me fix the merge conflict" → git checkout -- . (discards all modifications)
  • "I'll clean up untracked files" → git clean -fd (permanently deletes untracked files)

DCG intercepts dangerous commands before execution and blocks them with a clear explanation, giving you a chance to stash your changes first.

Critical Design Principles

1. Whitelist-First Architecture

Safe patterns are checked before destructive patterns. This ensures explicitly safe commands are never accidentally blocked:

git checkout -b feature    →  Matches SAFE "checkout-new-branch"  →  ALLOW
git checkout -- file.txt   →  No safe match, matches DESTRUCTIVE  →  DENY

2. Fail-Safe Defaults (Default-Allow)

Unrecognized commands are allowed by default. This ensures:

  • The hook never breaks legitimate workflows
  • Only known dangerous patterns are blocked
  • New git commands work until explicitly categorized

3. Zero False Negatives Philosophy

The pattern set prioritizes never allowing dangerous commands over avoiding false positives. A few extra prompts for manual confirmation are acceptable; lost work is not.

What It Blocks

Git Commands That Destroy Uncommitted Work

CommandReason
git reset --hardDestroys uncommitted changes
git reset --mergeDestroys uncommitted changes
git checkout -- <file>Discards file modifications
git restore <file> (without --staged)Discards uncommitted changes
git clean -fPermanently deletes untracked files

Git Commands That Destroy Remote History

CommandReason
git push --force / -fOverwrites remote commits
git branch -DForce-deletes without merge check

Git Commands That Destroy Stashed Work

CommandReason
git stash dropPermanently deletes a stash
git stash clearPermanently deletes all stashes

Filesystem Commands

CommandReason
rm -rf (outside /tmp, /var/tmp, $TMPDIR)Recursive deletion is dangerous

What It ALLOWS

Safe operations pass through silently:

Always Safe Git Operations

git status, git log, git diff, git add, git commit, git push, git pull, git fetch, git branch -d (safe delete with merge check), git stash, git stash pop, git stash list

Explicitly Safe Patterns

PatternWhy Safe
git checkout -b <branch>Creating new branches
git checkout --orphan <branch>Creating orphan branches
git restore --staged <file>Unstaging only, doesn't touch working tree
git restore -S <file>Short flag for staged
git clean -n / --dry-runPreview mode, no actual deletion
rm -rf /tmp/*Temp directories are ephemeral
rm -rf $TMPDIR/*Shell variable forms

Safe Alternative: --force-with-lease

git push --force-with-lease   # ALLOWED - refuses if remote has unseen commits
git push --force              # BLOCKED - can overwrite others' work

Modular Pack System

DCG uses a modular "pack" system to organize patterns by category:

Core Packs (Always Enabled)

PackDescription
core.gitDestructive git commands
core.filesystemDangerous rm -rf outside temp

Database Packs

PackDescription
database.postgresqlDROP/TRUNCATE in PostgreSQL
database.mysqlDROP/TRUNCATE in MySQL/MariaDB
database.mongodbdropDatabase, drop()
database.redisFLUSHALL/FLUSHDB
database.sqliteDROP in SQLite

Container Packs

PackDescription
containers.dockerdocker system prune, docker rm -f
containers.composedocker-compose down --volumes
containers.podmanpodman system prune

Kubernetes Packs

PackDescription
kubernetes.kubectlkubectl delete namespace
kubernetes.helmhelm uninstall
kubernetes.kustomizekustomize delete patterns

Cloud Provider Packs

PackDescription
cloud.awsDestructive AWS CLI commands
cloud.gcpDestructive gcloud commands
cloud.azureDestructive az commands

Infrastructure Packs

PackDescription
infrastructure.terraformterraform destroy
infrastructure.ansibleDangerous ansible patterns
infrastructure.pulumipulumi destroy

System Packs

PackDescription
system.diskdd, mkfs, fdisk operations
system.permissionsDangerous chmod/chown patterns
system.servicessystemctl stop/disable patterns

Other Packs

PackDescription
strict_gitExtra paranoid git protections
package_managersnpm unpublish, cargo yank

Configuring Packs

# ~/.config/dcg/config.toml
[packs]
enabled = [
    "database.postgresql",
    "containers.docker",
    "kubernetes",  # Enables all kubernetes sub-packs
]

Environment Variables

VariableDescription
DCG_PACKS="containers.docker,kubernetes"Enable packs (comma-separated)
DCG_DISABLE="kubernetes.helm"Disable packs/sub-packs
DCG_VERBOSE=1Verbose output
`DCG_COLOR=auto\always\
DCG_BYPASS=1Bypass DCG entirely (escape hatch)

Installation

Quick Install (Recommended)

curl -fsSL "https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/main/install.sh?$(date +%s)" | bash

# Easy mode: auto-update PATH
curl -fsSL "https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/main/install.sh?$(date +%s)" | bash -s -- --easy-mode

# System-wide (requires sudo)
curl -fsSL "https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/main/install.sh?$(date +%s)" | sudo bash -s -- --system

From Source (Requires Rust Nightly)

cargo +nightly install --git https://github.com/Dicklesworthstone/destructive_command_guard

Prebuilt Binaries

Available for: Linux x86_64, Linux ARM64, macOS Intel, macOS Apple Silicon, Windows

Claude Code Configuration

Add to ~/.claude/settings.json:

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "dcg"
          }
        ]
      }
    ]
  }
}

Important: Restart Claude Code after adding the hook.

How It Works

Processing Pipeline

┌─────────────────────────────────────────────────────────────────┐
│                        Claude Code                               │
│  Agent executes `rm -rf ./build`                                │
└─────────────────────┬───────────────────────────────────────────┘
                      │
                      ▼ PreToolUse hook (stdin: JSON)
┌─────────────────────────────────────────────────────────────────┐
│                          dcg                                     │
│  ┌──────────────┐    ┌──────────────┐    ┌──────────────┐       │
│  │    Parse     │───▶│  Normalize   │───▶│ Quick Reject │       │
│  │    JSON      │    │   Command    │    │   Filter     │       │
│  └──────────────┘    └──────────────┘    └──────┬───────┘       │
│                                                  │               │
│                      ┌───────────────────────────┘               │
│                      ▼                                           │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │                   Pattern Matching                        │   │
│  │   1. Check SAFE_PATTERNS (whitelist) ──▶ Allow if match  │   │
│  │   2. Check DESTRUCTIVE_PATTERNS ──────▶ Deny if match    │   │
│  │   3. No match ────────────────────────▶ Allow (default)  │   │
│  └──────────────────────────────────────────────────────────┘   │
└─────────────────────┬───────────────────────────────────────────┘
                      │
                      ▼ stdout: JSON (deny) or empty (allow)

Stage 1: JSON Parsing

  • Reads hook input from stdin
  • Validates Claude Code's PreToolUse format
  • Non-Bash tools immediately allowed

Stage 2: Command Normalization

  • Strips absolute paths: /usr/bin/git status → git status
  • Preserves argument paths

Stage 3: Quick Rejection Filter

  • SIMD-accelerated substring search for "git" or "rm"
  • Commands without these bypass regex entirely (99%+ of commands)

Stage 4: Pattern Matching

  • Safe patterns checked first (short-circuit on match → allow)
  • Destructive patterns checked second (match → deny)
  • No match → default allow

Exit Codes

CodeMeaning
0Command is safe, proceed
2Command is blocked, do not execute

CLI Usage

Test commands manually:

# Show version with build metadata
dcg --version

# Test a command
echo '{"tool_name":"Bash","tool_input":{"command":"git reset --hard"}}' | dcg

Example Block Message

════════════════════════════════════════════════════════════════════════
BLOCKED  dcg
────────────────────────────────────────────────────────────────────────
Reason:  git reset --hard destroys uncommitted changes. Use 'git stash' first.

Command:  git reset --hard HEAD~1

Tip: If you need to run this command, execute it manually in a terminal.
     Consider using 'git stash' first to save your changes.
════════════════════════════════════════════════════════════════════════

Contextual Suggestions

Command TypeSuggestion
git reset, git checkout --"Consider using 'git stash' first"
git clean"Use 'git clean -n' first to preview"
git push --force"Consider using '--force-with-lease'"
rm -rf"Verify the path carefully before running manually"

Edge Cases Handled

Path Normalization

/usr/bin/git reset --hard          # Blocked
/usr/local/bin/git checkout -- .   # Blocked
/bin/rm -rf /home/user             # Blocked

Flag Ordering Variants

rm -rf /path          # Combined flags
rm -fr /path          # Reversed order
rm -r -f /path        # Separate flags
rm --recursive --force /path    # Long flags

All variants are handled.

Shell Variable Expansion

rm -rf $TMPDIR/build           # Allowed (temp)
rm -rf ${TMPDIR}/build         # Allowed
rm -rf "$TMPDIR/build"         # Allowed
rm -rf "${TMPDIR:-/tmp}/build" # Allowed

Staged vs Worktree Restore

git restore --staged file.txt    # Allowed (unstaging only)
git restore -S file.txt          # Allowed (short flag)
git restore file.txt             # BLOCKED (discards changes)
git restore --worktree file.txt  # BLOCKED (explicit worktree)
git restore -S -W file.txt       # BLOCKED (includes worktree)

Performance Optimizations

DCG is designed for zero perceived latency:

OptimizationTechnique
Lazy StaticRegex patterns compiled once via LazyLock
SIMD Quick Rejectmemchr crate for CPU vector instructions
Early ExitSafe match returns immediately
Zero-Copy JSONserde_json operates on input buffer
Zero-AllocationCow<str> for path normalization
Release Profileopt-level="z", LTO, single codegen unit

Result: Sub-millisecond execution for typical commands.

Pattern Counts

TypeCount
Safe patterns (whitelist)34
Destructive patterns (blacklist)16

Security Considerations

What DCG Protects Against

  • Accidental data loss from git checkout -- or git reset --hard
  • Remote history destruction from force pushes
  • Stash loss from git stash drop/clear
  • Filesystem accidents from rm -rf outside temp directories

What DCG Does NOT Protect Against

  • Malicious actors (can bypass the hook)
  • Non-Bash commands (Python/JavaScript file writes, API calls)
  • Committed but unpushed work
  • Commands inside scripts (./deploy.sh contents not inspected)

Threat Model

DCG assumes the AI agent is well-intentioned but fallible. It catches honest mistakes, not adversarial attacks.

Troubleshooting

Hook not blocking commands

1. Verify ~/.claude/settings.json has hook configuration 2. Restart Claude Code 3. Test manually: echo '{"tool_name":"Bash","tool_input":{"command":"git reset --hard"}}' | dcg

Hook blocking safe commands

1. Check if there's an edge case not covered 2. File a GitHub issue 3. Temporary bypass: DCG_BYPASS=1 or run command manually

FAQ

Q: Why block `git branch -D` but allow `git branch -d`?

Lowercase -d only deletes branches fully merged. Uppercase -D force-deletes regardless of merge status, potentially losing commits.

Q: Why is `git push --force-with-lease` allowed?

Force-with-lease refuses to push if the remote has commits you haven't seen, preventing accidental overwrites.

Q: Why block all `rm -rf` outside temp directories?

Recursive forced deletion is extremely dangerous. A typo or wrong variable can delete critical files. Temp directories are designed to be ephemeral.

Q: What if I really need to run a blocked command?

DCG instructs the agent to ask for permission. Run the command manually in a separate terminal after making a conscious decision.

Integration with Flywheel

ToolIntegration
Claude CodeNative PreToolUse hook
Agent MailAgents can report blocked commands to coordinator
BVFlag tasks that repeatedly trigger DCG
CASSSearch DCG block patterns across sessions
RUDCG protects agent-sweep from destructive commits

Related skills

microsoftEntra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets484k1.3kmicrosoftAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.484k1.3kxixu-meOpenclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72better-authBetter Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.80.9k206firebaseFirebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.80.4k397squirrelscanAudit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.6k85
Securityappsecsecrets
Browse by category
AI & AgentsFrontend & DesignBackend & DataDev ToolsAutomationTesting & ReviewSecurityMonitoring & CloudDocs & Planning
Design & frontend
Design systemsAnimation & motionAccessibility (a11y)CSS & TailwindUI designUXDesign to codeshadcn/uiLanding pagesBest design skills
Most searched skills
find-skillscavemanfrontend-designbrainstormingsystematic-debuggingstop-slopemil-design-engui-ux-pro-maxkarpathy-guidelinesweb-design-guidelinesreact-best-practicesgrill-meimprovemicrosoft-foundryagent-browser
Browse all listings
All agent skillsAll MCP serversAll marketplacesAll plugins

This week in AI coding

Five minutes, every Monday - the tools, releases and tactics for developers.

unsubscribe anytime.