SkillVerdict
All verdicts

git-guardrails-claude-code

Install with caution mattpocock/skills

A 507-byte hook that blocks git push and reset --hard, but fails open without jq and misses git -C repo push. A seatbelt, not a boundary.

Verified · Repo on GitHub

What it does

Sets up a Claude Code PreToolUse hook that blocks risky git commands before they run: git push (any variant), git reset --hard, git clean -f / -fd, git branch -D, git checkout . and git restore .. The skill asks whether to install it for one project or for all projects, copies a 507-byte shell script into .claude/hooks/, merges the hook into your settings.json and tests it.

Who made it / license / last checked

Matt Pocock (mattpocock/skills) · License: MIT (repo LICENSE) · Repo last commit checked: 2026-10-31 (the skill folder last changed on 2026-08-19)

Install

claude plugin install mattpocock-skills@claude-plugins-official

From the repo README (Claude Code route; it installs the whole pack). For other agents the README gives npx skills@latest add mattpocock/skills -a <agent>, but the hook itself is Claude Code only. We did not run the installer or the script.

What files / scripts it runs

SKILL.md (2,313 bytes), scripts/block-dangerous-git.sh (507 bytes) and an agents/openai.yaml display file. The script reads the tool call from stdin with jq, greps the command against 9 patterns and exits with code 2 (blocked) on a match. The skill edits .claude/settings.json or ~/.claude/settings.json. The model can invoke it on its own.

Pros

  • Small and fully readable: one short script, no network, no dependencies beyond bash and jq
  • Asks for scope and merges into existing settings instead of overwriting them
  • Includes a one-line test that should print BLOCKED and exit 2

Cons

  • Fails open: if jq is missing, the command reads as empty, nothing matches and every git command is allowed (found by reading the script, not by running it)
  • Plain substring patterns are easy to miss: git -C repo push, git --no-pager push, git clean -xdf, git checkout -- . and git branch --delete --force do not match any pattern
  • It only matches the Bash tool; a command run through another shell tool is not checked
  • It also blocks harmless text, such as a commit message that contains "reset --hard"

Alternatives

Claude Code's own permission rules: a deny entry such as Bash(git push *) in settings.json needs no script and no jq. Use the hook on top of deny rules, not instead of them.

Notes

A seatbelt, not a security boundary: it stops an agent from pushing or wiping work by accident, not a determined one. Skills.sh listed git-guardrails-claude-code at 531K installs on 3 Nov 2026.

Sources

Verified on 2026-11-03 from the GitHub API (repo commit 4ae2317, 2026-10-31; folder commit 3216582, 2026-08-19; sizes are the API blob sizes) and the skills.sh leaderboard fetched that day. Nothing was installed or executed. Install counts are distribution, not quality.