---
id: ssh2-git-guardrails-claude-code
name: "git-guardrails-claude-code"
url: https://skills.yangsir.net/skill/ssh2-git-guardrails-claude-code
author: mattpocock
domain: ai-code-generation-quality
tags: ["git-workflows", "code-review", "ci/cd", "version-control", "developer-best-practices"]
install_count: 106600
rating: 4.80 (20 reviews)
github: https://github.com/mattpocock/skills
---

# git-guardrails-claude-code

> 负责配置Claude Code钩子，以阻止潜在危险的Git命令（如强制推送），确保代码库的安全性和完整性。

**Stats**: 106,600 installs · 4.8/5 (20 reviews)

## Before / After 对比

### 部署Git安全防护，规避危险操作

## Readme

# Setup Git Guardrails

Sets up a PreToolUse hook that intercepts and blocks dangerous git commands before Claude executes them.

## What Gets Blocked

- `git push` (all variants including `--force`)
- `git reset --hard`
- `git clean -f` / `git clean -fd`
- `git branch -D`
- `git checkout .` / `git restore .`

When blocked, Claude sees a message telling it that it does not have authority to access these commands.

## Steps

### 1. Ask scope

Ask the user: install for **this project only** (`.claude/settings.json`) or **all projects** (`~/.claude/settings.json`)?

### 2. Copy the hook script

The bundled script is at: [scripts/block-dangerous-git.sh](scripts/block-dangerous-git.sh)

Copy it to the target location based on scope:

- **Project**: `.claude/hooks/block-dangerous-git.sh`
- **Global**: `~/.claude/hooks/block-dangerous-git.sh`

Make it executable with `chmod +x`.

### 3. Add hook to settings

Add to the appropriate settings file:

**Project** (`.claude/settings.json`):

```json
{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/block-dangerous-git.sh"
          }
        ]
      }
    ]
  }
}
```

**Global** (`~/.claude/settings.json`):

```json
{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "~/.claude/hooks/block-dangerous-git.sh"
          }
        ]
      }
    ]
  }
}
```

If the settings file already exists, merge the hook into existing `hooks.PreToolUse` array — don't overwrite other settings.

### 4. Ask about customization

Ask if user wants to add or remove any patterns from the blocked list. Edit the copied script accordingly.

### 5. Verify

Run a quick test:

```bash
echo '{"tool_input":{"command":"git push origin main"}}' | <path-to-script>
```

Should exit with code 2 and print a BLOCKED message to stderr.


---
*Source: https://skills.yangsir.net/skill/ssh2-git-guardrails-claude-code*
*Markdown mirror: https://skills.yangsir.net/api/skill/ssh2-git-guardrails-claude-code/markdown*