Purpose
Before executing a Bash command in a session, check whether it contains a destructive pattern; if a match is found, warn the user first and obtain confirmation before executing, reducing the risk of accidental operations. Suitable for working with production, debugging live systems, or shared environments.
Core Objective
Primary Objective: Before each Bash command execution, if a destructive pattern is detected, first AskUserQuestion to warn and wait for the user to confirm or cancel; execute only after confirmation.
Success Criteria(all requirements must be met):
- ✅ Pattern check: Before executing any Bash command, check the command string against the table below
- ✅ Warn on match: If a destructive pattern is matched, use AskUserQuestion to show the command, risk, and options (A) Continue B) Cancel)
- ✅ Safe exceptions: Patterns in the "Safe Exceptions" table below do not trigger a warning
- ✅ User can override: If the user chooses to continue, execute the command; if they choose to cancel, do not execute
- ✅ Session-wide effect: After the skill is activated, all Bash commands in this session are subject to this constraint
Acceptance Test: If the user input contains rm -rf /important command, does the Agent warn first and wait for confirmation?
Scope Boundaries
This skill is responsible for：
- Identification and warning of destructive patterns
- Allowing safe exceptions (build artifact directories, etc.)
This skill is not responsible for：
- Directory edit scope restrictions (freeze-type capabilities; can be implemented separately if needed)
- Mandatory interception before execution (depends on whether the host supports PreToolUse; this skill is prose guidance, and the Agent checks on its own)
Handoff point: After the skill is activated, it remains in effect until the session ends; the user can choose "Continue" at any time to override a single warning.
Use Cases
- The user says "be careful", "safety mode", "prod mode"
- Working with production environments or shared repositories
- Before operations that may affect data
- When debugging live issues
Behavior
Activation
When the user requests this skill, output:
Safety mode active. I will warn before running any command matching destructive patterns. You can override each warning.
Destructive Pattern Table
| Pattern | Example | Risk |
|---|---|---|
rm -rf / rm -r / rm --recursive |
rm -rf /var/data |
Recursive delete |
DROP TABLE / DROP DATABASE |
DROP TABLE users; |
Data loss |
TRUNCATE |
TRUNCATE orders; |
Data loss |
git push --force / -f |
git push -f origin main |
History rewrite |
git reset --hard |
git reset --hard HEAD~3 |
Uncommitted work loss |
git checkout . / git restore . |
git checkout . |
Uncommitted work loss |
kubectl delete |
kubectl delete pod |
Production impact |
docker rm -f / docker system prune |
docker system prune -a |
Container/image loss |
Safe Exceptions (no warning)
rm -rf node_modules/.next/dist/__pycache__/.cache/build/.turbo/coverage
Execution Flow
- Bash command received: Before calling the Bash tool, check whether the command string matches a pattern in the table above (including safe exceptions).
- If matched: AskUserQuestion, for example:
The following command matches a destructive pattern: [命令] Risk: [对应风险描述] A) Proceed anyway B) Cancel - User selects A: Execute the command.
- User selects B: Do not execute, output "Command cancelled."
- If not matched: Execute directly.
Input & Output
Input
- User activation request (e.g. "be careful", "safety mode")
Output
- Warning prompt for destructive commands within the session
- Execution or cancellation after user confirmation
Restrictions
Hard boundaries
- Only checks the command string of Bash tool calls; does not parse pipes, subshells, or indirect calls within scripts
- If the host supports hooks such as PreToolUse, users can configure their own check scripts (see docs/guides/project-config.md）
Skill Boundaries
Do not do these (other skills can handle them)：
- Directory editing restrictions: not the responsibility of this skill; must be implemented independently
Self-Check
Success Criteria
- The destructive pattern table has been fully cross-checked
- Safety exceptions have been correctly excluded
- A warning is given before execution when a match occurs
- The user can choose to proceed or cancel
- All Bash commands within the session are subject to this constraint
Acceptance Test
When inputting rm -rf /tmp/test(or any destructive command), does a warning appear first and wait for confirmation?
Examples
Example 1: rm -rf triggers a warning
Command：rm -rf /var/cache
Behavior: matches rm -rf, AskUserQuestion warns "Recursive delete"; if the user chooses A, execute; if B, cancel.
Example 2: Safety exception does not warn
Command：rm -rf node_modules
Behavior: belongs to a safety exception, does not warn, executes directly.
Example 3: git push --force triggers a warning
Command：git push -f origin main
Behavior: matches force-push, warns "History rewrite"; executes after user confirmation.
Appendix: Output Contract
This skill produces session-level warning prompts and user confirmation results:
| Element | Format | Required Fields | Path Pattern |
|---|---|---|---|
| Warning prompt | AskUserQuestion text | Fields: original triggering command / matched pattern name / risk description / options A=Proceed / B=Cancel | Standard session output, not written to disk |
| Confirmation result | Scalar | decision ∈ {proceed, cancel}; when cancel, output "Command cancelled." | Standard session output |
| Match decision table | Internal cross-reference table (output only during debugging) | pattern_id / matched_substring / safe_exception_applied（bool） | Explicitly requested only during troubleshooting |