Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+22 moreClaude CodeCursorCodex CLIMuseDots
OpenClaw
Manus
Grok
Grok Bot+18 agentsAgent Safety Hooks: Block Destructive Commands, Leaked Keys
A PreToolUse hook pack that checks every Bash command before your coding agent runs it and denies or asks on broad deletes, force-pushes to protected branches, history rewrites and keys in commands.
$5
Agent Safety Hooks: Block Destructive Commands, Leaked Keys
Example session with this skill installed
Show me what the hook would block before I install it.
- Read your context and instructions
- Compiled the agent safety hooks
I ran the bundled selftest before installing anything. It feeds 63 fixture commands to the hook and compares each decision with the expected one. Nothing is executed: the hook only reads the command text.
Selftest (excerpt)
| case | expected | got | reason the agent sees |
|---|---|---|---|
| recursive delete of home | deny | deny | recursive delete of the home folder; name the exact folder inside the project, or ask the user to do it |
| flags reordered and split | deny | deny | recursive delete of the home folder; name the exact folder inside the project, or ask the user to do it |
| inside bash -c | deny | deny | recursive delete of the home folder; name the exact folder inside the project, or ask the user to do it |
| force-push to main | deny | deny | force-push to protected branch main; push to a new branch and open a pull request instead |
| plus refspec to main | deny | deny | force-push to protected branch main; push to a new branch and open a pull request instead |
| force without branch | ask | ask | force-push without an explicit branch; the target may be protected. Name the branch, or confirm |
| lease to main | ask | ask | --force-with-lease to protected branch main still rewrites shared history; confirm with the user |
| reset --hard | ask | ask | git reset --hard discards uncommitted work; consider git stash or a backup branch first |
| download piped to shell | ask | ask | downloaded text is piped into bash; download the script, read it, then run it |
| GitHub token in a header | deny | deny | the command line contains what looks like a secret: GitHub token (40 chars). Put it in an environment variable or a file the tool reads, not in the command. |
| ask earlier in the line does not hide a deny | deny | deny | recursive delete of the home folder; name the exact folder inside the project, or ask the user to do it (and 1 more finding) |
| fork bomb | deny | deny | fork bomb pattern |
| delete inside the project | silent | silent | (silent: normal permission flow) |
| delete text in echo | silent | silent | (silent: normal permission flow) |
| force-push own branch | silent | silent | (silent: normal permission flow) |
| env var reference, not a value | silent | silent | (silent: normal permission flow) |
Result: 63 of 63 cases as expected.
The hook's answer for a force-push to main
Input: the sample PreToolUse event for git push --force origin main.
{
"hookSpecificOutput": {
"hookEventName": "PreToolUse",
"permissionDecision": "deny",
"permissionDecisionReason": "safety-hooks: force-push to protected branch main; push to a new branch and open a pull request instead"
}
}
What this means
Deny: recursive deletes of broad folders, force-pushes and mirror pushes to protected branches, disk-wiping commands and credentials typed into a command. Claude sees the reason and can pick a safer route.
Ask: git reset --hard, git clean -f, a force-push without a named branch, --force-with-lease to a protected branch and a download piped into a shell. You confirm first.
Silent: everything else, such as deleting a build folder inside the project, echo with dangerous-looking text or force-pushing your own feature branch, goes through the normal permission flow.
Want me to install it for this project? I will merge it into .claude/settings.json and never overwrite hooks you already have.
Connects securely to your tools. The creator never sees your data.
About this skill
Use when you let an agent run shell commands and want a seatbelt that does not depend on the model remembering a rule. A standard-library Python hook, built for the hook system in Claude Code, follows its documented PreToolUse format: it denies recursive deletes of broad folders, force-pushes and mirror pushes to protected branches (configurable), disk-wiping commands and credentials typed into a command, and it asks before git reset --hard, git clean -f, a force-push without a branch, --force-with-lease to a protected branch, or a download piped into a shell. Every command in the line is checked and deny wins over ask. It handles the common spellings: short flags in any order, long options and their abbreviations, shell keywords such as if and do, wrappers such as sudo, env and xargs, paths with .., and bash -c, eval and command substitutions; the known misses are listed in the package. Credential reasons show a type label and length only; the hook never prints the value. It reduces risk; it does not make dangerous actions impossible: aliases, script files, python -c, encoded payloads and tools other than Bash are not inspected. A selftest shows the main rules firing before you install. Do not use when you want a code review, branch protection on your Git host, or hooks for tools other than Bash.
Example prompts
- "Add safety hooks that block force-pushes to main in this repo."
- "Show me what the hook would block before I install it."
- "Install the guard for all my projects and protect main, stable and release/* branches."
Requires
Claude Code with hooks (v2.1.295 or later for the fail-closed onFailure setting; older versions work without it), Python 3.8+ (standard library only).
Compatibility
Built for the hook system in Claude Code (the PreToolUse event on the Bash tool). It is not a general SKILL.md workflow for other agents.
Limits
Pattern-based and Bash-only. It complements protected branches on your Git host and keeping credentials out of the agent's environment; it does not replace them.
Independence
Not affiliated with or endorsed by Anthropic. Claude Code is named in plain text only to say which hook system the package is built for.
How to use
- 1
Connect your agent to the Agensi MCP
Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup
- 2
Sign in to Agensi
Your agent shows a sign-in link. Sign in and click Allow.
- 3
Ask for what you need
Your agent loads this skill and uses it on your task. It always asks before any payment.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scanned
Verified clean today
- Passed all security checks, Safe to install
Requires
Git