ai-bash-guard — Claude Code hook: blocks dangerous commands
An AI agent inspects every bash command before execution, catching destructive patterns like recursive deletes outside /tmp, force pushes to protected branches, database drops, and credential leaks, then blocks them with a reason.
npx claude-code-templates@latest --hook security/ai-bash-guardWhat ai-bash-guard does
The hook runs via PreToolUse with type:agent — the only pattern that can prevent tool execution through AI reasoning. Before any bash command reaches the terminal, Claude Haiku checks it against a ruleset: no rm -rf outside /tmp, no git push --force to main/master/develop/production, no DROP TABLE or DELETE without WHERE on production databases, no commands writing KEY, TOKEN, SECRET, or PASSWORD variables to files or over the network, and no dd, shred, or mkfs on physical devices.
If a command matches any rule, the hook returns deny with guidance on what to do instead. Everything else runs: deletes in /tmp, force pushes to personal branches, DROP TABLE in test databases. Timeout is 20 seconds; model is Haiku.
What it helps with
- Block recursive file deletion outside temporary directories
- Prevent force push to main repository branches
- Stop deletion or truncation of production tables without a condition
- Catch accidental credential writes to files or network
- Alert on attempts to overwrite disks via dd, shred, or mkfs
Example prompts for the agent
- Write a cleanup script using
rm -rf /var/logs/*— the hook stops it and suggests a safer approach - Try to force push to the main branch — the hook blocks and explains how to push to a feature branch instead
- Run
DROP TABLE userson a production database — the hook intercepts and redirects you to a test environment
How to install ai-bash-guard
1claude-code-templates
npx claude-code-templates@latest --hook security/ai-bash-guard2Manually: put the files in place
.claude/settings.jsonThe hooks block: event (PreToolUse, PostToolUse, Stop…) → command. Personal ones go to ~/.claude/settings.json
Step by step, with commands for each platform: Claude Code hooks: what they are, where to configure them, how to block a risky command
Questions about ai-bash-guard
How do I install ai-bash-guard in Claude Code?
Run npx claude-code-templates@latest --hook security/ai-bash-guard, then edit .claude/settings.json to integrate the hook.
What does ai-bash-guard block?
Recursive deletion outside /tmp, force push to protected branches (main, master, develop, production), DROP TABLE or DELETE without WHERE on production databases, commands writing API keys and tokens to files, dd and mkfs on physical disks.
Which commands does the hook always allow?
Deletes in /tmp, force push to personal feature branches, DROP TABLE on test, dev, or local databases, any other bash commands that don't match the dangerous patterns.
Source text
ai-bash-guard.json · MIT
{
"description": "AI-powered bash command security guard. Before any Bash command runs, a lightweight Claude subagent evaluates it for destructive or irreversible patterns — recursive deletes, force pushes to protected branches, database drops, and credential exposure — and blocks execution with a clear explanation if flagged. Uses PreToolUse with type:agent, which is the only hook pattern that can block tool execution via AI reasoning.",
"hooks": {
"PreToolUse": [
{
"matcher": "Bash",
"hooks": [
{
"type": "agent",
"prompt": "You are a security guard for a developer's terminal. Evaluate the bash command provided in the tool input for destructive or irreversible risk.\n\nDENY the command if it matches ANY of these patterns:\n- Recursive deletion outside /tmp: rm -rf on non-temporary paths\n- Force push to protected branches: git push --force or -f targeting main, master, develop, or production\n- Destructive database operations without a WHERE clause: DROP TABLE, TRUNCATE, DELETE on production-named databases\n- Credential exposure: commands that write environment variables containing KEY, TOKEN, SECRET, or PASSWORD to files or network destinations\n- Disk-level destruction: dd, shred, or mkfs targeting non-loop devices\n\nALLOW everything else, including rm on /tmp, force pushes to personal feature branches, and DROP TABLE in databases named test, dev, or local.\n\nRespond ONLY with a JSON object in exactly this format:\n\nIf DENYING:\n{\"hookSpecificOutput\": {\"hookEventName\": \"PreToolUse\", \"permissionDecision\": \"deny\", \"permissionDecisionReason\": \"<one sentence: what is dangerous and what to do instead>\"}}\n\nIf ALLOWING:\n{\"hookSpecificOutput\": {\"hookEventName\": \"PreToolUse\", \"permissionDecision\": \"allow\"}}",
"timeout": 20,
"model": "haiku"
}
]
}
]
}
}
© davila7 · MIT · davila7/claude-code-templates
