careful

其他社区 v0.1.0

作者仓库星标 0
作者更新于 2026年8月24日 23:55
作者仓库 gstack

解读按原文结构重写，命令、链接、术语均保留；右侧可核对作者原始 SKILL.md

设计思路

careful 是一个「session 级安全模式开关」——开启后，bash 命令在执行前会被一个 hook 扫一遍，命中危险模式就让 LLM 停下来问你一句再决定。它不是杀菌剂、不是审计工具，是给 agent 加一层最后的防呆刹车，避免 rm -rf /var/data 这种 typo 一气呵成。作者把保护清单和安全例外都列得极清楚，没有暗箱。

受保护的命令模式（直接抄作者原文）

模式	例子	风险
`rm -rf` / `rm -r` / `rm --recursive`	`rm -rf /var/data`	递归删除
`DROP TABLE` / `DROP DATABASE`	`DROP TABLE users;`	数据丢失
`TRUNCATE`	`TRUNCATE orders;`	数据丢失
`git push --force` / `-f`	`git push -f origin main`	历史覆写
`git reset --hard`	`git reset --hard HEAD~3`	未提交工作丢失
`git checkout .` / `git restore .`	`git checkout .`	未提交工作丢失
`kubectl delete`	`kubectl delete pod`	生产环境影响
`docker rm -f` / `docker system prune`	`docker system prune -a`	容器 / 镜像丢失

安全例外

这些清理类命令是允许直接通过的：rm -rf node_modules / .next / dist / __pycache__ / .cache / build / .turbo / coverage。日常清缓存不会被打断。

工作机制

hook 从 Bash 工具的 tool input JSON 里读到要执行的命令字符串，按上述模式匹配；命中就返回 permissionDecision: "ask"，附带警告语；用户可以选择继续或取消。hook 是 session 范围，新开会话或结束当前 session 会自动失效，不需要主动卸载。

适合谁

让 LLM 自动跑命令时希望多一道防呆的人
给新来的同事 / 实习生跑 agent，担心他们直接同意危险操作
在生产代码库工作，怕一时手滑

不适合

一次性的 sandbox / 容器内——本来就隔离了，再加 hook 反而打断节奏
你需要做的就是大量删除——guardrails 会一直打断

配套

和 unfreeze（解冻分支）、finishing-a-development-branch 配合，发布前的危险操作链路全程被守护。

When to invoke this skill

Warns before rm -rf, DROP TABLE, force-push, git reset --hard, kubectl delete, and similar destructive operations. User can override each warning. Use when touching prod, debugging live systems, or working in a shared environment. Use when asked to "be careful", "safety mode", "prod mode", or "careful mode".

/careful — Destructive Command Guardrails

Safety mode is now active. Every bash command will be checked for destructive patterns before running. If a destructive command is detected, you'll be warned and can choose to proceed or cancel.

mkdir -p ~/.gstack/analytics
echo '{"skill":"careful","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'","repo":"'$(basename "$(git rev-parse --show-toplevel 2>/dev/null)" 2>/dev/null || echo "unknown")'"}'  >> ~/.gstack/analytics/skill-usage.jsonl 2>/dev/null || true

What's protected

Pattern	Example	Risk
`rm -rf` / `rm -r` / `rm --recursive`	`rm -rf /var/data`	Recursive delete
`DROP TABLE` / `DROP DATABASE`	`DROP TABLE users;`	Data loss
`TRUNCATE`	`TRUNCATE orders;`	Data loss
`git push --force` / `-f`	`git push -f origin main`	History rewrite
`git reset --hard`	`git reset --hard HEAD~3`	Uncommitted work loss
`git checkout .` / `git restore .`	`git checkout .`	Uncommitted work loss
`kubectl delete`	`kubectl delete pod`	Production impact
`docker rm -f` / `docker system prune`	`docker system prune -a`	Container/image loss

Safe exceptions

These patterns are allowed without warning:

rm -rf node_modules / .next / dist / __pycache__ / .cache / build / .turbo / coverage

How it works

The hook reads the command from the tool input JSON, checks it against the patterns above, and returns a hookSpecificOutput payload with permissionDecision: "ask" and a warning reason if a match is found (the decision must be nested under hookSpecificOutput — Claude Code ignores a top-level permissionDecision). You can always override a MEDIUM warning and proceed.

HIGH tier (hard deny)

Two catastrophic shapes are denied, not asked: rm -r/-R of exactly /, ~, or $HOME, and force-push to the repo's default branch. SIMPLE commands only (no ;, &&, ||, |, newline) — compound shapes fall through to the MEDIUM ask; --force-with-lease is never HIGH. A best-effort advisory hard-stop, not a policy boundary: the escape hatch is ending the opt-in, session-scoped /careful session.

Project patterns (additive only)

Add warn rules — one POSIX ERE per line, # comments OK — in ~/.gstack/careful-patterns.txt (global) or ~/.gstack/projects/<slug>/careful-patterns.txt (per-project). Consulted after the built-in families, so config can only ADD rules, never suppress a baseline warning. Invalid regex lines are skipped.

To deactivate, end the conversation or start a new one. Hooks are session-scoped.

流狐档案作者与许可取自来源；运行、权限和网络为流狐检测或估算

流狐分类: 通用
作者声明 Agent: 未找到明确声明；不据此推断已兼容或已测试
静态检查: 87 / 100 · 启发式扫描，不代表运行安全
作者 / 版本 / 许可: @garrytan · v0.1.0 · 未声明 license
流狐 Token 估算: 低消耗
流狐接入估算: 需手动接入
是否需要外部 API Key: 未发现要求
检测到的系统要求: Docker
底层运行要求: Bun · Docker
检测到的文件与系统行为: 只读
允许写入 / 修改
检测到的网络行为: 仅限本地
安装命令数: 无（仅作为资料）

档案由构建时根据 SKILL.md 与安装命令自动衍生，可能与作者实际意图存在差异。

需要注意： 未限定 allowed-tools，默认拥有全部工具权限。；检出高风险片段：rm_rf_root

输出预览 careful.preview

作者没有在当前 SKILL.md 中定义固定输出样例。

SKILL.md SKILL.md

<!-- AUTO-GENERATED from SKILL.md.tmpl — do not edit directly -->
<!-- Regenerate: bun run gen:skill-docs -->


## When to invoke this skill

Warns before rm -rf, DROP TABLE,
force-push, git reset --hard, kubectl delete, and similar destructive operations.
User can override each warning. Use when touching prod, debugging live systems,
or working in a shared environment. Use when asked to "be careful", "safety mode",
"prod mode", or "careful mode".

# /careful — Destructive Command Guardrails

Safety mode is now **active**. Every bash command will be checked for destructive
patterns before running. If a destructive command is detected, you'll be warned
and can choose to proceed or cancel.

```bash
mkdir -p ~/.gstack/analytics
echo '{"skill":"careful","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'","repo":"'$(basename "$(git rev-parse --show-toplevel 2>/dev/null)" 2>/dev/null || echo "unknown")'"}'  >> ~/.gstack/analytics/skill-usage.jsonl 2>/dev/null || true
```

## What's protected

| Pattern | Example | Risk |
|---------|---------|------|
| `rm -rf` / `rm -r` / `rm --recursive` | `rm -rf /var/data` | Recursive delete |
| `DROP TABLE` / `DROP DATABASE` | `DROP TABLE users;` | Data loss |
| `TRUNCATE` | `TRUNCATE orders;` | Data loss |
| `git push --force` / `-f` | `git push -f origin main` | History rewrite |
| `git reset --hard` | `git reset --hard HEAD~3` | Uncommitted work loss |
| `git checkout .` / `git restore .` | `git checkout .` | Uncommitted work loss |
| `kubectl delete` | `kubectl delete pod` | Production impact |
| `docker rm -f` / `docker system prune` | `docker system prune -a` | Container/image loss |

## Safe exceptions

These patterns are allowed without warning:

…

证据边界与执行链路

作者原文负责流程事实；流狐只索引当前章节、要点、文件与命令。

章节    -> When to invoke this skill → What's protected → Safe exceptions → How it works → HIGH tier (hard deny) → Project patterns (additive only)
要点    -> active · denied · default branch · Warns before rm -rf, DROP TABLE, force-push, git reset --hard, kubectl delete, and similar destructive operations. · Safety mode is now active. · Two catastrophic shapes are denied, not asked: rm -r/-R of exactly /, ~, or $HOME, and force-push to the repo's default branch. · To deactivate, end the conversation or start a new one.
文件/命令 -> rm -rf · rm -r · rm --recursive · rm -rf /var/data · DROP TABLE · DROP DATABASE · DROP TABLE users; · TRUNCATE
内容 SHA-256 -> 0da2110532f6