Git Guardrails Claude Code

Git Guardrails for Claude Code

Prevent Claude Code from executing destructive git operations via PreToolUse hooks.

When to use this skill

• Protecting critical repositories from accidental destructive git commands
• Setting up safety nets before giving Claude Code broad git permissions
• After an incident involving unintended git destructive operations

When not to use this skill

• General git workflow guidance → use git-workflow
• Non-Claude-Code platforms → hooks are Claude Code-specific

Blocked operations

The guardrail blocks:

• git push --force / git push -f
• git reset --hard
• git clean -f / git clean -fd
• git branch -D
• git checkout -- . / git checkout -- <file>
• git restore (destructive forms)

Installation

Step 1 — Choose scope

Project-level (recommended for critical repos):

mkdir -p .claude/hooks

Global (for all Claude Code sessions):

mkdir -p ~/.claude/hooks

Step 2 — Create the blocking script

Save as .claude/hooks/git-guardrails.sh (or ~/.claude/hooks/git-guardrails.sh):

#!/bin/bash
# Blocks destructive git operations

COMMAND="$1"

if echo "$COMMAND" | grep -qE 'git (push --force|push -f|reset --hard|clean -f|clean -fd|branch -D|checkout -- |restore )'; then
  echo "BLOCKED: Claude does not have authority to run destructive git operations."
  echo "Command attempted: $COMMAND"
  echo "If you need this operation, run it yourself in the terminal."
  exit 2
fi

exit 0

chmod +x .claude/hooks/git-guardrails.sh

Step 3 — Register the hook in settings

Add to .claude/settings.json (project) or ~/.claude/settings.json (global):

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": ".claude/hooks/git-guardrails.sh"
          }
        ]
      }
    ]
  }
}

For global installation, use the full path: ~/.claude/hooks/git-guardrails.sh

Step 4 — Verify

echo "git reset --hard" | .claude/hooks/git-guardrails.sh
# Should exit with status 2 and print BLOCKED message

Customization

Edit the regex pattern in the script to add or remove blocked operations:

# Add git tag -d to blocked list:
grep -qE 'git (push --force|push -f|reset --hard|clean -f|clean -fd|branch -D|checkout -- |restore |tag -d)'

Instructions

1. Identify the task trigger and expected output.
2. Follow the workflow steps in this skill from top to bottom.
3. Validate outputs before moving to the next step.
4. Capture blockers and fallback path if any step fails.

Examples

• Example: Apply this skill to a small scope first, then scale to full scope after validation passes.

Best practices

• Keep outputs deterministic and auditable.
• Prefer small reversible changes over broad risky edits.
• Record assumptions explicitly.

References

• Project standards: .agent-skills/skill-standardization/SKILL.md
• Validator script: .agent-skills/skill-standardization/scripts/validate_skill.sh