git-guardrails-claude-code
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves a defensive purpose, allowing users to configure a 'PreToolUse' hook that acts as a safety filter for Git operations. It blocks a specific list of high-risk commands such as
git push --force,git reset --hard, andgit clean -fto prevent accidental data loss. - [COMMAND_EXECUTION]: The included bash script (
scripts/block-dangerous-git.sh) implements a complex state machine to parse shell commands without using dangerous functions likeeval. It correctly handles common command wrappers likesudoandenv, and tracks command substitutions to prevent bypass techniques, employing a 'fail-closed' strategy for ambiguous inputs. - [SAFE]: No malicious patterns, unauthorized data exfiltration, or remote code execution vectors were detected. The setup process involves local configuration changes that are standard for tool-use hooks in the Claude Code environment and are performed at the user's discretion.
Audit Metadata