safe-shell — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited safe-shell (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Fixes: UpGuard / ClaudeLog YOLO-mode postmortems (Dec 2025) — documented home-directory deletions and rm -rf / from root when Claude Code ran with --dangerously-skip-permissions and no supervision.
"A Claude Code session running with `--dangerously-skip-permissions` issued `rm -rf ~/` while attempting to 'clean up the project directory.' The user lost their entire home folder." — Dec 2025 postmortem
Anthropic's own permission prompt is the safety net for destructive commands. In YOLO mode (--dangerously-skip-permissions or --permission-mode bypassPermissions), that net is gone. safe-shell sits below the permission layer and refuses a curated list of irreversible operations regardless of permission mode.
| Category | Examples | ||
|---|---|---|---|
| Filesystem wipes | rm -rf /, rm -rf ~/, rm -rf $HOME, rm --no-preserve-root | ||
| Credential / git destruction | rm -rf .git, rm -rf ~/.ssh, git reset --hard HEAD~3, git clean -fd, git branch -D | ||
| Force-push | git push --force, git push -f (including --force-with-lease) | ||
| Disk-level | mkfs, fdisk, parted, dd of=/dev/sd* | ||
| Permission nukes | chmod -R 777 /, chown -R … / | ||
| Remote-code-exec | `curl … \ | sh, wget … \ | bash` |
| Fork bombs | `:(){ :\ | :& };:` |
Commands that look destructive but operate on local project paths (rm -rf node_modules, rm -rf ./dist, git reset --hard HEAD) are allowed — the list is curated for catastrophic and irreversible operations only.
Claude wants to call Bash with command X
│
▼
PreToolUse hook fires
│
▼
Match X against the block-list regex set
│
┌────┴────┐
│ │
▼ ▼
No match Match
│ │
▼ ▼
exit 0 Emit { hookSpecificOutput.permissionDecision: "deny",
silent permissionDecisionReason: "<explanation>" }
on stdout. Claude Code refuses the call and feeds the
reason back to Claude as an error./claude-papercuts:safe-shell${CLAUDE_PLUGIN_ROOT}/skills/safe-shell/hooks/guard.sh tosee the current rule set.
matches a block-list pattern (read the regex set, don't guess).
remove a rule, ask them to file an issue at https://github.com/dhruba-datta/claude-papercuts/issues.
tell them to run it in their own shell — safe-shell intentionally has no override flag.
hazard, most-irreversible commands. It does not stop crafted obfuscation (e.g. r''m -rf /, base64-encoded payloads, multi-step scripts). Treat it as a seatbelt, not a vault.
via the hook reason; nothing is written to disk.
command is refused outright. The user is expected to run intentional destructive operations in their own shell.
--dangerously-skip-permissions, theblock stands.
No network calls. Hook reads only the Bash command string passed by Claude Code.
If Anthropic ships a first-class destructive-command refusal layer that survives --dangerously-skip-permissions, this skill becomes a duplicate and gets deprecated in the next monthly release with the date.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.