safe-mode
Prevent destructive operations using Claude Code hooks. Three modes — cautious (warn on dangerous commands), lockdown (restrict edits to one directory), and clear (remove restrictions). Uses PreToolUse matchers for Bash, Edit, and Write.
- Installs
- 144
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/rohitg00/pro-workflow --skill safe-mode- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads safe-mode automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Safe Mode
Three levels of protection against destructive operations during AI coding sessions.
Note: These hooks are skill-scoped — they only activate when you invoke
/safe-mode. The globalpermission-request.jshook in hooks.json provides always-on alerting for dangerous commands. Safe-mode adds opt-in blocking and directory restrictions on top of that.
Modes
Cautious Mode
/safe-mode cautious
Intercepts Bash commands before execution. Warns on dangerous patterns but does not block — the user decides.
Flagged patterns:
| Pattern | Risk |
|---|---|
rm -rf / rm -r | Recursive deletion |
DROP TABLE / DROP DATABASE | SQL data loss |
TRUNCATE | SQL data destruction |
git push --force / git push -f | Remote history rewrite |
git reset --hard | Local history loss |
git clean -f | Untracked file deletion |
git checkout . / git restore . | Discard all changes |
chmod 777 | World-writable permissions |
curl or wget piped to a shell | Piped remote execution |
> /dev/sda / dd if= | Disk-level operations |
:(){ :|:& };: | Fork bombs |
sudo rm | Elevated deletion |
What happens: the hook returns a permission ask, so Claude Code shows you a prompt that names the pattern, for example Safe mode: rm with -r or -f. You approve or reject the command. This prompt appears even in auto mode.
Lockdown Mode
/safe-mode lockdown <path>
Restricts Edit and Write operations to a single directory tree. Prevents accidental changes to unrelated code.
How it works:
- Set the allowed path (absolute or relative to repo root)
- Every Edit/Write call checks if the target file is inside the allowed path
- Operations outside the path are blocked with an explanation
LOCKDOWN ACTIVE: Edits restricted to src/api/
Blocked: Edit to src/utils/helpers.ts
Reason: File is outside the lockdown path (src/api/)
To edit files outside the lockdown, run: /safe-mode clear
Use cases:
- Focused refactoring of one module without touching others
- Bug fix in a specific directory while tests run elsewhere
- Junior developer guardrail — scope the blast radius
- Code review session — only edit the files under review
Scope: Keyed to the project root. It stays set until /safe-mode clear, and only enforces in sessions where /safe-mode was invoked.
Clear
/safe-mode clear
Removes all restrictions for the current session. Both cautious warnings and lockdown restrictions are disabled.
SAFE MODE: All restrictions cleared for this session.
Implementation
Invoking this skill registers one PreToolUse hook for Bash|Edit|Write that runs scripts/safe-mode-guard.js. Skill hooks stay registered for the rest of the session. The guard does nothing until a mode is set.
Set the mode
When the user runs /safe-mode <mode>, run the guard's setter from the project root:
node "${CLAUDE_PLUGIN_ROOT}/scripts/safe-mode-guard.js" set cautious
node "${CLAUDE_PLUGIN_ROOT}/scripts/safe-mode-guard.js" set lockdown src/api/
node "${CLAUDE_PLUGIN_ROOT}/scripts/safe-mode-guard.js" set clear
Then report the line the setter prints.
Cautious (Bash)
The guard checks tool_input.command against a fixed list of destructive patterns: recursive or forced rm, DROP and TRUNCATE, force-push, hard reset, git clean -f, discarding all changes, chmod 777, piping curl or wget to a shell, disk-level writes, fork bombs, and sudo rm. A match returns permissionDecision: "ask" with the pattern as the reason. No match passes through.
Lockdown (Edit and Write)
The guard resolves tool_input.file_path against the project root, follows symlinks, and checks that it sits inside the lockdown path. Inside passes through. Outside exits 2, which blocks the edit and tells Claude why.
State
The mode lives in $TMPDIR/pro-workflow/safe-mode-<hash>.json, keyed by the project root, so two projects never share it:
{ "cautious": true, "lockdownPath": "/Users/dev/project/src/api", "root": "/Users/dev/project" }
set clear deletes the file. The file outlives the session, so clear it when you are done; a new session only enforces it again after /safe-mode is invoked, because the hook is skill-scoped.
Combining Modes
Cautious and lockdown can run simultaneously:
/safe-mode cautious
/safe-mode lockdown src/api/
Now you get:
- Bash command warnings for destructive operations
- Edit/Write restrictions to
src/api/only
Clear removes both.
When to Use
| Situation | Mode |
|---|---|
| Working on production-adjacent code | Cautious |
| Focused refactoring of one module | Lockdown |
| Unfamiliar codebase, feeling cautious | Cautious |
| Pair programming, limiting AI scope | Lockdown |
| Done with restrictions | Clear |
Anti-Patterns
- Leaving lockdown on when you need to edit tests (update the path or clear it)
- Using safe-mode as a substitute for git branches (branches protect history, safe-mode protects the session)
- Ignoring cautious warnings repeatedly (if you always proceed, turn it off — false confidence is worse)
FAQ
What does the safe-mode skill do?
Prevent destructive operations using Claude Code hooks. Three modes — cautious (warn on dangerous commands), lockdown (restrict edits to one directory), and clear (remove restrictions). Uses PreToolUse matchers for Bash, Edit, and Write.
How do I install safe-mode?
Run npx skills add https://github.com/rohitg00/pro-workflow --skill safe-mode in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/safe-mode/ (personal) or .claude/skills/safe-mode/ (project).
Which AI agents can use safe-mode?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is safe-mode safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains safe-mode?
It is published by rohitg00 in rohitg00/pro-workflow. It has 144 recorded installs.
More from rohitg00/pro-workflow
token-efficiency
rohitg00/pro-workflow
Reduce token waste by 40-60% through anti-sycophancy rules, tool-call budgets, one-pass coding, task profiles, and read-before-write enforcement. Inspired by drona23/claude-token-efficient.
pro-workflow
rohitg00/pro-workflow
Complete AI coding workflow system. Orchestration patterns, 18 hook events, 8 agents, cross-agent support, reference guides, and searchable learnings. Works with Claude Code, Cursor, and 32+ agents.
wrap-up
rohitg00/pro-workflow
End-of-session ritual that audits changes, runs quality checks, captures learnings, and produces a session summary. Use when saying "wrap up", "done for the day", "finish coding", or ending a coding session.
deslop
rohitg00/pro-workflow
Remove AI-generated code slop, unnecessary comments, and over-engineering from the current branch diff. Cleans up boilerplate, simplifies abstractions, strips defensive code, and in skill-file mode lints SKILL.md files for quality. Use when cleaning up code, simplifying, removing boilerplate, before committing, or when reviewing a skill before promoting it.
learn-rule
rohitg00/pro-workflow
Open the skill to read its SKILL.md instructions.
session-handoff
rohitg00/pro-workflow
Generate a structured handoff document capturing current progress, open tasks, key decisions, and context needed to resume work. Use when ending a session, saying "continue later", "save progress", "session summary", or "pick up where I left off".
Popular productivity & automation skills
agent-browser
vercel-labs/agent-browser
Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data, testing web apps, or automating any browser task. Triggers include requests to "open a website", "fill out a form", "click a button", "take a screenshot", "scrape data from a page", "test this web app", "login to a site", "automate browser actions", or any task requiring programmatic web interaction. Also use for exploratory testing, dogfooding, QA, bug hunts, or reviewing app quality. Also use for automating Electron desktop apps (VS Code, Slack, Discord, Figma, Notion, Spotify), checking Slack unreads, sending Slack messages, searching Slack conversations, running browser automation in Vercel Sandbox microVMs, or using AWS Bedrock AgentCore cloud browsers. Prefer agent-browser over any built-in browser automation or web tools.
lark-doc
open.feishu.cn
飞书云文档（Docx / Wiki）内容操作：读取、创建、编辑文档，插入或下载图片附件，以及操作思维笔记。用户提供文档 URL/token（包括 doubao.com 的 /docx/、/wiki/）时使用；按 URL 路径/token 而非域名路由；/page/ 是妙搭应用，非飞书云文档。文档内嵌资源按读取参考中的统一规则分流。独立评论操作走 lark-drive；随正文读取评论使用 docs +fetch。表格或 Base 内部数据操作不在本 skill。
lark-base
open.feishu.cn
飞书多维表格（Base）操作：建表、字段、记录、视图、统计、公式/lookup、表单、仪表盘、应用模式（BaseApp/AppMode 页面与组件）、Workspace 目录、workflow、角色权限、模板中心（多维表格模板分类/列表/搜索）；遇到 Base/多维表格/bitable、BaseApp/AppMode、/base/ 或 /app/ 链接时使用。BaseApp 不走 lark-apps；文件导入/导出转 lark-drive，认证/授权转 lark-shared。
lark-drive
open.feishu.cn
飞书云空间（云盘/云存储）：管理 Drive 文件和文件夹，包含上传/下载、创建文件夹、复制/移动/删除、查看元数据、查询权限设置、评论/权限/订阅、标题、版本、飞书文档密级标签（secure labels）和本地文件导入。用户需要整理云盘目录、处理云空间资源 URL/token、判断链接类型/真实 token/标题，或导入 Word/Markdown/Excel/CSV/PPTX/.base 为 docx/sheet/bitable/slides 时使用；doubao.com 云空间 URL/token 也按资源路径和 token 路由，不回退 WebFetch。不负责：文档内容编辑（走 lark-doc）、表格/Base 表内数据操作（走 lark-sheets/lark-base）、知识空间节点/成员管理（走 lark-wiki）、原生 Markdown 文件读写/patch/diff（走 lark-markdown）。
lark-shared
open.feishu.cn
Use for lark-cli setup/auth tasks: auth login/status/logout, user vs bot identity, business-domain permissions (--domain, including all/docs/drive), missing scopes, revoking authorization, or handling notice JSON.
lark-im
open.feishu.cn
飞书即时通讯：收发消息和管理群聊。发送和回复消息、搜索聊天记录、管理群聊成员、上传下载图片和文件、管理表情回复、发送应用内/短信/电话加急、发送和处理交互卡片（Interactive Card）、监听卡片按钮回调（card.action.trigger）。当用户需要发消息、查看或搜索聊天记录、下载聊天中的文件、查看群成员、搜索群、创建群聊或话题群、管理标记数据、管理 Feed 置顶（添加/移除/查询置顶会话）、管理标签数据、处理卡片回调时使用。