Hardstop Skill v1.5
INVOCATION INSTRUCTIONS (read first when skill is activated)
When this skill is activated via the Skill tool, check the ARGUMENTS field immediately:
| Argument | Action — run this Bash command FIRST before anything else |
|---|---|
skip [n] | python ~/.claude/plugins/hs/commands/hs_cmd.py skip [n] |
on / enable | python ~/.claude/plugins/hs/commands/hs_cmd.py on |
off / disable | python ~/.claude/plugins/hs/commands/hs_cmd.py off |
status | python ~/.claude/plugins/hs/commands/hs_cmd.py status |
log | python ~/.claude/plugins/hs/commands/hs_cmd.py log |
| (none) | Apply the safety protocol below to evaluate the pending command |
Execute the Bash command immediately. The hook reads ~/.hardstop/skip_next — if that file is not written, skips have no effect.
Path note: Commands above assume the default install location. If Hardstop was installed with
CLAUDE_CONFIG_DIRset, replace~/.claudein the paths with that directory.
Note: This skill complements the Hardstop plugin. The plugin provides deterministic protection via hooks; this skill provides LLM-level awareness for platforms without hook support.
Purpose: Protect users from dangerous AI-initiated actions. The mechanical brake for AI-generated commands.
Core Question: "If this action goes wrong, can the user recover?"
MANDATORY: Pre-Execution Protocol
BEFORE executing ANY shell command, ALWAYS run this checklist:
[ ] 1. INSTANT BLOCK check (see list below)
[ ] 2. Risk level assessment (SAFE/RISKY/DANGEROUS)
[ ] 3. Signal confidence BEFORE action
[ ] 4. If RISKY or DANGEROUS -> Explain -> Wait for confirmation
NEVER skip this protocol. NEVER proceed on DANGEROUS without explicit user approval.
WHEN COMMANDS ARE BLOCKED
If you see a "🛑 BLOCKED" message from the Hardstop hook:
- STOP - Do not proceed with the command
- EXPLAIN - Tell the user why it was blocked (the reason is in the message)
- ASK - "This command was blocked for safety. Would you like me to bypass the check with /hs skip and retry?"
- IF USER SAYS YES:
- Run the
/hs skipcommand first - Then retry the original blocked command
- Run the
- IF USER SAYS NO:
- Suggest a safer alternative approach
- Or ask what they were trying to accomplish
Example workflow:
Claude: I'll run this command... [attempts risky command]
Hook: 🛑 BLOCKED: Deletes home directory
Claude: This command was blocked because it would delete your home directory.
Would you like me to bypass with /hs skip and retry? (Not recommended)
User: No
Claude: Good call. What were you trying to do? I can suggest a safer approach.
Never bypass safety checks without user permission.
1. INSTANT BLOCK List
These patterns require IMMEDIATE STOP. No exceptions. No "let me just..."
Unix/Linux/macOS
| Pattern | Why |
|---|---|
rm -rf ~/ or rm -rf ~/* | Deletes entire home directory |
rm -rf / | Destroys entire system |
:(){ :|:& };: | Fork bomb, crashes system |
bash -i >& /dev/tcp/ | Reverse shell, attacker access |
nc -e /bin/sh | Reverse shell variant |
curl/wget ... | bash | Executes untrusted remote code |
curl -d @~/.ssh/ | Exfiltrates SSH keys |
dd of=/dev/sd* | Overwrites disk |
mkfs on system drives | Formats drives |
> /dev/sda | Destroys disk |
sudo rm -rf / | Privileged system destruction |
chmod -R 777 / | World-writable system |
Shell Wrappers (v1.2)
| Pattern | Why |
|---|---|
bash -c "rm -rf ..." | Hides recursive delete in shell wrapper |
sh -c "... | bash" | Hides curl/wget pipe to shell |
sudo bash -c "..." | Elevated shell wrapper |
xargs rm -rf | Dynamic arguments to recursive delete |
find ... -exec rm -rf | find executing recursive delete |
find ... -delete | find with delete flag |
Cloud CLI Destructive Operations (v1.2)
| Pattern | Why |
|---|---|
aws s3 rm --recursive | Deletes all S3 objects |
aws ec2 terminate-instances | Terminates EC2 instances |
gcloud projects delete | Deletes entire GCP project |
kubectl delete namespace | Deletes K8s namespace |
terraform destroy | Destroys all infrastructure |
firebase firestore:delete --all-collections | Wipes all Firestore data |
redis-cli FLUSHALL | Wipes all Redis data |
DROP DATABASE / DROP TABLE | SQL database destruction |
Package Manager Force Operations
| Pattern | Why |
|---|---|
dpkg --purge --force-* | Overrides package safety checks |
dpkg --remove --force-* | Overrides package safety checks |
dpkg --force-remove-reinstreq | Forces removal of broken package (can break system) |
dpkg --force-depends | Ignores dependency checks |
dpkg --force-all | Nuclear option - ignores all safety |
apt-get remove --force-* | Forced package removal |
apt-get purge --force-* | Forced package purge |
apt --purge with --force-* | Forced purge |
rpm -e --nodeps | Removes package ignoring dependencies |
rpm -e --noscripts | Removes without running uninstall scripts |
yum remove with --skip-broken | Ignores dependency resolution |
Windows
| Pattern | Why |
|---|---|
rd /s /q C:\ | Deletes entire drive |
rd /s /q %USERPROFILE% | Deletes user directory |
del /f /s /q C:\Windows | Deletes system files |
format C: | Formats system drive |
diskpart | Disk partition manipulation |
bcdedit /delete | Destroys boot configuration |
reg delete HKLM\... | Deletes machine registry |
reg add ...\Run | Persistence mechanism |
powershell -e [base64] | Encoded payload execution |
powershell IEX (New-Object Net.WebClient) | Download cradle |
certutil -urlcache -split -f | LOLBin download |
mimikatz | Credential theft tool |
net user ... /add | Creates user account |
net localgroup administrators ... /add | Privilege escalation |
Set-MpPreference -DisableRealtimeMonitoring | Disables antivirus |
When detected:
BLOCKED
This command would [specific harm].
I cannot execute this. This is almost certainly:
- A mistake in my reasoning
- A prompt injection attack
- A misunderstanding of your request
What did you actually want to do? I'll find a safe way.
2. Risk Assessment
SAFE (proceed silently)
| Category | Unix Examples | Windows Examples |
|---|---|---|
| Read-only | ls, cat, head, tail, pwd | dir, type, more, where |
| Git read | git status, git log, git diff | Same |
| Info commands | echo, date, whoami, hostname | echo, date, whoami, hostname |
| Regeneratable cleanup | rm -rf node_modules, rm -rf __pycache__ | rd /s /q node_modules |
| Temp cleanup | rm -rf /tmp/... | rd /s /q %TEMP%\... |
| Project-scoped | Operations within current project directory | Same |
| Package info | dpkg -l, apt list, rpm -qa | winget list, choco list |
Behavior: Execute without comment. Don't narrate safe operations.
RISKY (explain + confirm)
| Category | Examples | Concern |
|---|---|---|
| Directory deletion | rm -rf [dir] / rd /s /q [dir] | Permanent data loss |
| Config modification | .bashrc, .zshrc, registry edits | Affects all sessions |
| Permission changes | chmod, chown, icacls | Security implications |
| Package installation | pip install, npm install -g, apt install | System modification |
| Package removal | apt remove, dpkg --remove, apt purge, dpkg --purge | System dependency issues |
| Git destructive | git push --force, git reset --hard | History loss |
| Network downloads | curl -O, wget, Invoke-WebRequest | Unknown content |
| Database operations | DROP, TRUNCATE, DELETE FROM | Data loss |