Safety Guard

by affaan-mef648e01899ba3e8dc6371642deaaf64b4477775No license275K starsListed Oct 9, 2026Updated Oct 9, 2026Repository updated 4 days ago

Guard against destructive operations with three modes: Careful intercepts dangerous commands (rm -rf, git push --force, DROP TABLE) for confirmation, Freeze locks writes to one directory, and Guard combines both via PreToolUse hooks. Use when working on production systems, running agents autonomously, restricting edits to a directory, or during migrations, deploys, and data changes.

Instructions onlySecurity

AI-generated overview

Guards against destructive commands and restricts file writes to a chosen directory using three protection modes.

What it does: Safety Guard provides three protection modes: Careful intercepts destructive commands such as rm -rf, git push --force and DROP TABLE for confirmation; Freeze locks file edits to a specified directory tree; Guard combines both. It works through PreToolUse hooks that intercept Bash, Write, Edit and MultiEdit tool calls and check them against active rules before execution. Blocked actions are logged to a log file.
When to use it: It is intended for work on production systems, for autonomous agent sessions, and for restricting edits to a specific directory. It also suits sensitive operations such as migrations, deploys and data changes.
Requirements: No scripts are included; it is instructions only. It relies on PreToolUse hooks that intercept Bash, Write, Edit and MultiEdit tool calls, and it writes a log file under the user's home directory.

Safety Guard — Prevent Destructive Operations

When to Use

When working on production systems
When agents are running autonomously (full-auto mode)
When you want to restrict edits to a specific directory
During sensitive operations (migrations, deploys, data changes)

How It Works

Three modes of protection:

Mode 1: Careful Mode

Intercepts destructive commands before execution and warns:

Watched patterns:- rm -rf (especially /, ~, or project root)- git push --force- git reset --hard- git checkout . (discard all changes)- DROP TABLE / DROP DATABASE- docker system prune- kubectl delete- chmod 777- sudo rm- npm publish (accidental publishes)- Any command with --no-verify

Watched patterns:- rm -rf (especially /, ~, or project root)- git push --force- git reset --hard- git checkout . (discard all changes)- DROP TABLE / DROP DATABASE- docker system prune- kubectl delete- chmod 777- sudo rm- npm publish (accidental publishes)- Any command with --no-verify

When detected: shows what the command does, asks for confirmation, suggests safer alternative.

Mode 2: Freeze Mode

Locks file edits to a specific directory tree:

Any Write/Edit outside src/components/ is blocked with an explanation. Useful when you want an agent to focus on one area without touching unrelated code.

Mode 3: Guard Mode (Careful + Freeze combined)

Both protections active. Maximum safety for autonomous agents.

Agents can read anything but only write to src/api/. Destructive commands are blocked everywhere.

Unlock

Implementation

Uses PreToolUse hooks to intercept Bash, Write, Edit, and MultiEdit tool calls. Checks the command/path against the active rules before allowing execution.

Integration

Enable by default for codex -a never sessions
Pair with observability risk scoring in ECC 2.0
Logs all blocked actions to ~/.claude/safety-guard.log

Source and attribution

Source:affaan-m/ECCinskills/safety-guardat commitef648e0

License: No license

Content belongs to its original authors. SourceWeft indexes it from a public repository.

Report or request removal

Safety Guard

Safety Guard — Prevent Destructive Operations

When to Use

How It Works

Mode 1: Careful Mode

Mode 2: Freeze Mode

Mode 3: Guard Mode (Careful + Freeze combined)

Unlock

Implementation

Integration

Source and attribution

More from affaan-m/ECC

Unified Notifications Ops

Verification Loop

Ui To Vue

Unified Memory

Visa Doc Translate

Team Builder

More in Security

Kyc Rules

Kyc Rules

Compliance Tracking

Dpop Adoption

Secops Triage

Secops Investigate