guard

---

name: guard version: 0.1.0 description: | Full safety mode: destructive command warnings + directory-scoped edits. Combines /careful (warns before rm -rf, DROP TABLE, force-push, etc.) with /freeze (blocks edits outside a specified directory). Use for maximum safety when touching prod or debugging live systems. Use when asked to "guard mode", "full safety", "lock it down", or "maximum safety". (gstack) triggers:

• full safety mode
• guard against mistakes
• maximum safety allowed-tools:
• Bash
• Read
• AskUserQuestion hooks: PreToolUse:
  • matcher: "Bash" hooks:
    • type: command command: "bash ${CLAUDE_SKILL_DIR}/../careful/bin/check-careful.sh" statusMessage: "Checking for destructive commands..."
  • matcher: "Edit" hooks:
    • type: command command: "bash ${CLAUDE_SKILL_DIR}/../freeze/bin/check-freeze.sh" statusMessage: "Checking freeze boundary..."
  • matcher: "Write" hooks:
    • type: command command: "bash ${CLAUDE_SKILL_DIR}/../freeze/bin/check-freeze.sh" statusMessage: "Checking freeze boundary..."

---

/guard — Full Safety Mode

Activates both destructive command warnings and directory-scoped edit restrictions. This is the combination of

/careful

+

/freeze

in a single command.

Dependency note: This skill references hook scripts from the sibling

/careful

and

/freeze

skill directories. Both must be installed (they are installed together by the gstack setup script).

mkdir -p ~/.gstack/analytics
echo '{"skill":"guard","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'","repo":"'$(basename "$(git rev-parse --show-toplevel 2>/dev/null)" 2>/dev/null || echo "unknown")'"}'  >> ~/.gstack/analytics/skill-usage.jsonl 2>/dev/null || true

Setup

Ask the user which directory to restrict edits to. Use AskUserQuestion:

• Question: "Guard mode: which directory should edits be restricted to? Destructive command warnings are always on. Files outside the chosen path will be blocked from editing."
• Text input (not multiple choice) — the user types a path.

Once the user provides a directory path:

1. Resolve it to an absolute path:

FREEZE_DIR=$(cd "<user-provided-path>" 2>/dev/null && pwd)
echo "$FREEZE_DIR"

1. Ensure trailing slash and save to the freeze state file:

FREEZE_DIR="${FREEZE_DIR%/}/"
STATE_DIR="${CLAUDE_PLUGIN_DATA:-$HOME/.gstack}"
mkdir -p "$STATE_DIR"
echo "$FREEZE_DIR" > "$STATE_DIR/freeze-dir.txt"
echo "Freeze boundary set: $FREEZE_DIR"

Tell the user:

• "Guard mode active. Two protections are now running:"
• "1. Destructive command warnings — rm -rf, DROP TABLE, force-push, etc. will warn before executing (you can override)"
• "2. Edit boundary — file edits restricted to

  <path>/

  . Edits outside this directory are blocked."
• "To remove the edit boundary, run

  /unfreeze

  . To deactivate everything, end the session."

What's protected

See

/careful

for the full list of destructive command patterns and safe exceptions. See

/freeze

for how edit boundary enforcement works.