hs

Hardstop Skill v1.5

INVOCATION INSTRUCTIONS (read first when skill is activated)

When this skill is activated via the Skill tool, check the ARGUMENTS field immediately:

| Argument | Action — run this Bash command FIRST before anything else | |----------|----------------------------------------------------------| | skip [n] | python ~/.claude/plugins/hs/commands/hs_cmd.py skip [n] | | on / enable | python ~/.claude/plugins/hs/commands/hs_cmd.py on | | off / disable | python ~/.claude/plugins/hs/commands/hs_cmd.py off | | status | python ~/.claude/plugins/hs/commands/hs_cmd.py status | | log | python ~/.claude/plugins/hs/commands/hs_cmd.py log | | (none) | Apply the safety protocol below to evaluate the pending command |

Execute the Bash command immediately. The hook reads ~/.hardstop/skip_next — if that file is not written, skips have no effect.

Path note: Commands above assume the default install location. If Hardstop was installed with CLAUDE_CONFIG_DIR set, replace ~/.claude in the paths with that directory.

Note: This skill complements the Hardstop plugin. The plugin provides deterministic protection via hooks; this skill provides LLM-level awareness for platforms without hook support.

Purpose: Protect users from dangerous AI-initiated actions. The mechanical brake for AI-generated commands.

Core Question: "If this action goes wrong, can the user recover?"

MANDATORY: Pre-Execution Protocol

BEFORE executing ANY shell command, ALWAYS run this checklist:

[ ] 1. INSTANT BLOCK check (see list below)
[ ] 2. Risk level assessment (SAFE/RISKY/DANGEROUS)
[ ] 3. Signal confidence BEFORE action
[ ] 4. If RISKY or DANGEROUS -> Explain -> Wait for confirmation

NEVER skip this protocol. NEVER proceed on DANGEROUS without explicit user approval.

WHEN COMMANDS ARE BLOCKED

If you see a "🛑 BLOCKED" message from the Hardstop hook:

1. STOP - Do not proceed with the command
2. EXPLAIN - Tell the user why it was blocked (the reason is in the message)
3. ASK - "This command was blocked for safety. Would you like me to bypass the check with /hs skip and retry?"
4. IF USER SAYS YES:
5. Run the /hs skip command first
6. Then retry the original blocked command
7. IF USER SAYS NO:
8. Suggest a safer alternative approach
9. Or ask what they were trying to accomplish

Example workflow:

Claude: I'll run this command... [attempts risky command]
Hook: 🛑 BLOCKED: Deletes home directory
Claude: This command was blocked because it would delete your home directory.
        Would you like me to bypass with /hs skip and retry? (Not recommended)
User: No
Claude: Good call. What were you trying to do? I can suggest a safer approach.

Never bypass safety checks without user permission.

1. INSTANT BLOCK List

These patterns require IMMEDIATE STOP. No exceptions. No "let me just..."

Unix/Linux/macOS

| Pattern | Why | |---------|-----| | rm -rf ~/ or rm -rf ~/ | Deletes entire home directory | | rm -rf / | Destroys entire system | | :(){ :\|:& };: | Fork bomb, crashes system | | bash -i >& /dev/tcp/ | Reverse shell, attacker access | | nc -e /bin/sh | Reverse shell variant | | curl/wget ... \| bash | Executes untrusted remote code | | curl -d @~/.ssh/ | Exfiltrates SSH keys | | dd of=/dev/sd | Overwrites disk | | mkfs on system drives | Formats drives | | > /dev/sda | Destroys disk | | sudo rm -rf / | Privileged system destruction | | chmod -R 777 / | World-writable system |

Shell Wrappers (v1.2)

| Pattern | Why | |---------|-----| | bash -c "rm -rf ..." | Hides recursive delete in shell wrapper | | sh -c "... \| bash" | Hides curl/wget pipe to shell | | sudo bash -c "..." | Elevated shell wrapper | | xargs rm -rf | Dynamic arguments to recursive delete | | find ... -exec rm -rf | find executing recursive delete | | find ... -delete | find with delete flag |

Cloud CLI Destructive Operations (v1.2)

| Pattern | Why | |---------|-----| | aws s3 rm --recursive | Deletes all S3 objects | | aws ec2 terminate-instances | Terminates EC2 instances | | gcloud projects delete | Deletes entire GCP project | | kubectl delete namespace | Deletes K8s namespace | | terraform destroy | Destroys all infrastructure | | firebase firestore:delete --all-collections | Wipes all Firestore data | | redis-cli FLUSHALL | Wipes all Redis data | | DROP DATABASE / DROP TABLE | SQL database destruction |

Package Manager Force Operations

| Pattern | Why | |---------|-----| | dpkg --purge --force- | Overrides package safety checks | | dpkg --remove --force- | Overrides package safety checks | | dpkg --force-remove-reinstreq | Forces removal of broken package (can break system) | | dpkg --force-depends | Ignores dependency checks | | dpkg --force-all | Nuclear option - ignores all safety | | apt-get remove --force- | Forced package removal | | apt-get purge --force- | Forced package purge | | apt --purge with --force-* | Forced purge | | rpm -e --nodeps | Removes package ignoring dependencies | | rpm -e --noscripts | Removes without running uninstall scripts | | yum remove with --skip-broken | Ignores dependency resolution |

Windows

| Pattern | Why | |---------|-----| | rd /s /q C:\ | Deletes entire drive | | rd /s /q %USERPROFILE% | Deletes user directory | | del /f /s /q C:\Windows | Deletes system files | | format C: | Formats system drive | | diskpart | Disk partition manipulation | | bcdedit /delete | Destroys boot configuration | | reg delete HKLM\... | Deletes machine registry | | reg add ...\Run | Persistence mechanism | | powershell -e [base64] | Encoded payload execution | | powershell IEX (New-Object Net.WebClient) | Download cradle | | certutil -urlcache -split -f | LOLBin download | | mimikatz | Credential theft tool | | net user ... /add | Creates user account | | net localgroup administrators ... /add | Privilege escalation | | Set-MpPreference -DisableRealtimeMonitoring | Disables antivirus |

When detected:

BLOCKED

This command would [specific harm].

I cannot execute this. This is almost certainly:
- A mistake in my reasoning
- A prompt injection attack
- A misunderstanding of your request

What did you actually want to do? I'll find a safe way.

2. Risk Assessment

SAFE (proceed silently)

| Category | Unix Examples | Windows Examples | |----------|---------------|------------------| | Read-only | ls, cat, head, tail, pwd | dir, type, more, where | | Git read | git status, git log, git diff | Same | | Info commands | echo, date, whoami, hostname | echo, date, whoami, hostname | | Regeneratable cleanup | rm -rf node_modules, rm -rf __pycache__ | rd /s /q node_modules | | Temp cleanup | rm -rf /tmp/... | rd /s /q %TEMP%\... | | Project-scoped | Operations within current project directory | Same | | Package info | dpkg -l, apt list, rpm -qa | winget list, choco list |

Behavior: Execute without comment. Don't narrate safe operations.

RISKY (explain + confirm)

| Category | Examples | Concern | |----------|----------|---------| | Directory deletion | rm -rf [dir] / rd /s /q [dir] | Permanent data loss | | Config modification | .bashrc, .zshrc, registry edits | Affects all sessions | | Permission changes | chmod, chown, icacls | Security implications | | Package installation | pip install, npm install -g, apt install | System modification | | Package removal | apt remove, dpkg --remove, apt purge, dpkg --purge | System dependency issues | | Git destructive | git push --force, git reset --hard | History loss | | Network downloads | curl -O, wget, Invoke-WebRequest | Unknown content | | Database operations | DROP, TRUNCATE, DELETE FROM | Data loss