git-guardrails-claude-code

Use it when:: Claude Code runs shell commands for you and you don't want it able to push, or to throw away local work.
It does:: Installs a hook that stops git push, reset --hard, clean -f, branch -D, checkout . and restore . before they run.
You get:: A hook script and a settings entry, for this project or for all your projects.
Needs:: Claude Code; the hook script uses jq.
Keeps working:: In every later session, until you remove the hook.

TL;DR

A one-time setup for a Claude Code hook: a script that runs before each shell command and can block it. The agent asks whether to protect this project (.claude/settings.json) or every project (~/.claude/settings.json), copies the bundled script into the matching hooks folder and registers it, merging it into any settings you already have. From then on, a command matching a blocked pattern, including every kind of git push, is stopped before it runs, and Claude gets a message saying it isn't allowed to run it. The agent offers to add or remove patterns, then tests the script with a sample git push command. The script matches text anywhere in the command, so even a commit message that mentions "git push" gets blocked.

Summarizes the skill at 5beb35b.

npx skills add https://github.com/mattpocock/skills --skill git-guardrails-claude-code

skills.sh page Source on GitHub All skills from mattpocock/skills

Total Downloads: 545,797 on skills.sh, Nov 9, 2026
Repo stars: 318,714 mattpocock/skills
First seen: Feb 10, 2026 on skills.sh

Weekly Downloads

20.6K

-24% over the 8 weeks to Nov 9

Weekly values

Week to	Installs
Sep 21	26,919
Sep 28	24,124
Oct 5	24,213
Oct 12	29,989
Oct 19	25,807
Oct 26	23,387
Nov 2	21,442
Nov 9	20,567

Category	category:engineering category:security category:software-engineering Test-first work, implementation from specs, git hygiene and scope control. Compliance, guardrails, skill vetting and browser fingerprinting. Everything for building software: planning, coding, debugging, design, frameworks, cloud, agents and skills.
Type	type:setup One-time configuration or scaffolding of a project, account or tool.
Effect	effect:local Its own steps create or change files, git state or local tools.
Needs	needs:claude-code Uses Claude Code features such as hooks or background agents.
Publisher	by:community Everyone else. Unverified vendor claims default to community.
Topics	guardrails git security
Stack	stack:git

SKILL.md

From mattpocock/skills at 5beb35b. Checked daily, last changed Oct 20, 2026.

Frontmatter

name: git-guardrails-claude-code
description: Set up Claude Code hooks to block dangerous git commands (push, reset --hard, clean, branch -D, etc.) before they execute. Use when user wants to prevent destructive git operations, add git safety hooks, or block git push/reset in Claude Code.

Setup Git Guardrails

Sets up a PreToolUse hook that intercepts and blocks dangerous git commands before Claude executes them.

What Gets Blocked

git push (all variants including --force)
git reset --hard
git clean -f / git clean -fd
git branch -D
git checkout . / git restore .

When blocked, Claude sees a message telling it that it does not have authority to access these commands.

Steps

1. Ask scope

Ask the user: install for this project only (.claude/settings.json) or all projects (~/.claude/settings.json)?

2. Copy the hook script

The bundled script is at: scripts/block-dangerous-git.sh

Copy it to the target location based on scope:

Project: .claude/hooks/block-dangerous-git.sh
Global: ~/.claude/hooks/block-dangerous-git.sh

Make it executable with chmod +x.

3. Add hook to settings

Add to the appropriate settings file:

Project (.claude/settings.json):

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/block-dangerous-git.sh"
          }
        ]
      }
    ]
  }
}

Global (~/.claude/settings.json):

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "~/.claude/hooks/block-dangerous-git.sh"
          }
        ]
      }
    ]
  }
}

If the settings file already exists, merge the hook into the existing hooks.PreToolUse array. Don't overwrite other settings.

4. Ask about customization

Ask if user wants to add or remove any patterns from the blocked list. Edit the copied script accordingly.

5. Verify

Run a quick test:

echo '{"tool_input":{"command":"git push origin main"}}' | <path-to-script>

Should exit with code 2 and print a BLOCKED message to stderr.