Matt Pocock / skills/misc/git-guardrails-claude-code/SKILL.md
Git Guardrails for Claude Code
A Bash hook setup guide that blocks selected Git command text, with important gaps in command parsing and error handling.
Source reviewed · reviewed · Named sources were inspected. No runtime results are established by this label.
01 / Task fit
Where it may help.
These are intended uses indicated by the upstream material. They are not measured outcomes.
- Adding a narrow warning before selected Bash Git operations
- Reviewing the limits of a hook before installing it
What it is
This skill installs a shell script as a Claude Code PreToolUse hook. The script reads JSON input and looks for a small list of Git command patterns, returning exit 2 when it finds one. It is a reminder layer around selected operations, not a general command authorization system.
Why you might use it
It may help an operator notice a plain push, hard reset or forced clean before a Bash tool call runs. Use it only with an understanding of the matcher and its failure modes, and keep repository permissions and recovery measures in place.
Put it in context.
Illustrative requests and outputs to review. These examples are separate from the recorded evaluation below.
Check a project-only hook before adoption
Example request
In a disposable fixture, send the JSON command git push origin main to the hook and check for exit 2. Keep the represented Git command as input data; do not execute it or install global settings.
What to look for. A captured exit code and blocked message for the direct pattern, if the host dependencies are available.
Before you rely on it. IonBin could not run this hook in the current sandbox. Verify jq and the hook protocol before adoption.
Probe command variants
Example request
Compare JSON inputs for git push, git -C synthetic-repo push and a harmless quoted string containing git push. Record both missed blocks and false positives.
What to look for. An explicit list of what this pattern matcher does and does not intercept.
Before you rely on it. Even a passing small fixture suite cannot establish coverage for arbitrary shell syntax.
02 / Setup & access
What it asks of your environment.
Requirements
- Claude Code hook support and an operator-chosen project or global settings scope.
- Bash, jq, grep and cat must be available to the hook. Git Bash could not start in this evaluation sandbox.
- No account is required for testing JSON inputs; a live Git remote is not needed and was not used.
Permissions & data access
- Writes a hook file and merges .claude/settings.json when installed. Global scope affects all projects for that user.
- The hook reads proposed command text through stdin. The reviewed script does not execute that text.
Instructions alone do not enforce a sandbox. The agent host, connected tools and approvals determine what the skill can actually read, change or send.
03 / Things to check
Security concerns & practical limits.
These concerns follow from the reviewed sources. They describe possible exposure or required review; they are not confirmed vulnerabilities.
Higher attention
Substring patterns are not a Git permission boundary
The script searches for literal phrases such as git push. By source inspection, global Git options, tabs or a quoted executable can avoid those exact phrases, while a harmless quoted description can match them. Treat this as a convenience warning, not repository protection.
Higher attention
Parser errors have no explicit deny path
The script captures jq output but does not check jq exit status, validate the command field or stop on parser failure. Its final exit 0 means a missing parser or invalid JSON can reach an allow result by source inspection; runtime confirmation is still blocked.
Review before use
Coverage is limited to the Bash hook
Other tool names, direct process APIs, host configuration changes and commands outside the listed patterns are not covered by the documented matcher. Keep version-control permissions and backups independent of this hook.
Limits and nuances
- The hook did not execute: the host sandbox prevented Git Bash initialization before any test input could reach it. A scoped execution retry was not run because the automatic approval service reported a capacity error.
- Fifteen synthetic JSON cases are supplied in the reproduction harness, but none is counted as an executed hook test. No settings were changed and no represented Git command was executed.
- No installed host integration, alternate-shell coverage, exhaustive command parser analysis or security certification. Source review identifies concerns; it does not measure bypass frequency.
04 / Review record
What we checked. What’s still open.
Recorded review scope
- skills/misc/git-guardrails-claude-code/SKILL.md
- LICENSE
- skills/misc/git-guardrails-claude-code/scripts/block-dangerous-git.sh
- skills/misc/README.md
Not tested or established
- The hook did not execute: the host sandbox prevented Git Bash initialization before any test input could reach it. A scoped execution retry was not run because the automatic approval service reported a capacity error.
- Fifteen synthetic JSON cases are supplied in the reproduction harness, but none is counted as an executed hook test. No settings were changed and no represented Git command was executed.
- No installed host integration, alternate-shell coverage, exhaustive command parser analysis or security certification. Source review identifies concerns; it does not measure bypass frequency.
- Review date
- Source revision
49dd158d1076134a641b33efb035946536778336- Our relationship
- Explored. Investigated through the recorded review. No use or replication is claimed.
Upstream content can change after review. A repository revision identifies source scope; it does not prove that every script, dependency or runtime behavior was tested. How freshness is handled.
Recorded evaluation / Source review
Results with their limits attached.
Six source checks completed. Runtime attempted but blocked before Bash could initialize; zero hook cases executed. Literal-pattern and parser-failure concerns remain source findings.
- Passed
- 6
- Failed
- 0
- Total recorded
- 6
These counts refer to the cases in this report. They are not a benchmark against other skills. A source review does not establish runtime behavior.
Read the evidence reportDownload the authored reproduction harness (JSON bundle) ↗
The report provides the case definitions, observations and baseline scope. Missing baselines or untested behaviors remain limitations.
Recorded environment
- Pinned public UTF-8 sources; exact Git blob contents fetched through GitHub and recorded with SHA-256.
- Windows 11; Python 3.12.10 source-condition verification. No account, private document or live business data.
Recorded commands (2)
Commands document this evaluation. They are not setup instructions for your environment.
Read each pinned file listed in sourceManifest.python build-guide-reviews.py — verify the recorded source conditions and reconcile report counts.Findings from this evaluation
Higher attention
Substring patterns are not a Git permission boundary
The script searches for literal phrases such as git push. By source inspection, global Git options, tabs or a quoted executable can avoid those exact phrases, while a harmless quoted description can match them. Treat this as a convenience warning, not repository protection.
Higher attention
Parser errors have no explicit deny path
The script captures jq output but does not check jq exit status, validate the command field or stop on parser failure. Its final exit 0 means a missing parser or invalid JSON can reach an allow result by source inspection; runtime confirmation is still blocked.
Needs attention
Coverage is limited to the Bash hook
Other tool names, direct process APIs, host configuration changes and commands outside the listed patterns are not covered by the documented matcher. Keep version-control permissions and backups independent of this hook.
Observation
Current catalog placement is miscellaneous
The current repository keeps this entry under misc, outside the promoted plugin set. A high directory install count does not establish active upstream use or maintenance quality.
Evaluation limitations
- The hook did not execute: the host sandbox prevented Git Bash initialization before any test input could reach it. A scoped execution retry was not run because the automatic approval service reported a capacity error.
- Fifteen synthetic JSON cases are supplied in the reproduction harness, but none is counted as an executed hook test. No settings were changed and no represented Git command was executed.
- No installed host integration, alternate-shell coverage, exhaustive command parser analysis or security certification. Source review identifies concerns; it does not measure bypass frequency.
05 / Reuse & discovery
License, attribution & popularity.
MIT
Repository MIT license text inspected at this revision. Preserve its copyright and permission notice when redistributing covered source; separate dependencies and services can have their own terms.
Why it is in this collection
skills.sh displayed 479.9K installs for this named skill on the observation date. Rounded directory telemetry; not verified unique users, a quality score or measured growth.
479,900 skill installs on skills.sh
- Scope
- Directory listing for mattpocock-git-guardrails; not the whole repository
- Observed
- Time window
- Individual listing says Installs; reporting window not independently established
Popularity and inclusion do not establish quality, compatibility or security. Counts belong to their named metric and date; they are not a current ranking.
06 / Follow the evidence
Go to the original.
- Pinned skill instructions github.com
- Pinned repository license github.com
- Reviewed block-dangerous-git.sh github.com
- Reviewed README.md github.com
- Dated directory popularity context www.skills.sh
IonBin’s source notes are independent assessments. Upstream authors retain their work and attribution. This page does not install or execute the skill.