5 ms·

Show HN: A Claude Code plugin that catch destructive Git and filesystem commands

61 points by kenryu 11mo ago

WolfeReader 10mo ago
You should probably rely less on AI. If your first thought is "I need to delete some directories" and your immediate next thought is "I'd better ask an AI agent to do this for me", you are definitely exhibiting skill entropy.
- thrdbndndn 10mo ago
  What is "skill entropy"
  - intev 10mo ago
    They think it's a smart way to say that the o.p. is dumb.
    - WolfeReader 10mo ago
      Nope, skill atrophy can affect anyone at any level.
  - itemize123 10mo ago
    atrophy?
  - AdieuToLogic 10mo ago
    > What is "skill entropy" Skill entropy is a result of reliance on tools to perform tasks which otherwise would contribute to and/or reinforce a person's ability to master same. Without exercising one's acquired learning, skills can quickly fade. For example, an argument can be made that spellcheckers commonly available in programs degrade people's ability to spell correctly without this assistance (such as when using pen and paper).
  - WolfeReader 10mo ago
    I did mean "atrophy" as others mentioned.
- RogerL 10mo ago
  Claude does these things even though you have explicit instructions not to do them, this isn't a tool for you asking it to delete files. Just today Claude decided to do a git restore on me, blowing away local changes, despite having strict instructions to do nothing with git except to use it to look at history and branches. Why jump to the conclusion that the person is so incompetent with no evidence?
  - intev 10mo ago
    Because there's now a class of programmers who are very anti AI when it comes to coding because they think anybody who relies on it are degenerate vibe coders who have no idea what they are doing. You can see this in pretty much every single HN post w.r.t AI and coding.
    - WolfeReader 10mo ago
      There is indeed a class of programmers who think AI over-reliance will make us worse. And there should be, because it's true. https://www.mdpi.com/2075-4698/15/1/6 https://www.mdpi.com/2075-4698/15/1/6 https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4812513 https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4812513
      - blackqueeriroh 10mo ago
        Did you even read the abstracts of these papers? The first one has four important phrases: “negative correlation,” “mediated by increased cognitive offloading,” “higher educational attainment was associated with better critical thinking skills, regardless of AI usage,” and “potential costs.” The second paper has two: “students using GenAI tools score on average 6.71 (out of 100) points lower than non-users,” and “suggesting an effect whereby GenAI tool usage hinders learning.” I ask you, sir, where exactly do you get “AI over-reliance will make us worse…because it’s true” from TWO studies that go out of their way to make it clear there is no causative link, only correlation, point out significant mediations of the effect, identify only potentiality, and also show only half a letter grade difference, which when you’re dealing with students could be down to all sorts of things. Not to mention we’re dealing with one preprint and some truly confounding study design. If you don’t understand research methods, please stop presenting papers as if they are empirical authorities on truth. It diminishes trust in real academic work.
- joshribakoff 10mo ago
  Thanks for framing my physical disability as a skill issue. Injuries i sustained developing my skills beyond what most others were willing to do, but i guess my use of AI to assist my input so i can continue developing totally erases that experience.
  - WolfeReader 10mo ago
    I can see that my comment about disabled users really got under your skin. How fortunate, then, that I never actually made such a comment.
TheDong 10mo ago
In my opinion this is a solution at the wrong layer. It's working by trying to filter executed commands, but it doesn't work in many cases (even in 'strict mode'), and there's better, more complete, solutions. What do I mean by "it doesn't work"? Well, claude code is really good at executing things in unusual ways when it needs to, and this is trying to parse shell to catch them. When claude code has trouble running a bash command, it sometimes will say something like "The current environment is wonky, let's put it in a file and run that", and then use the edit tool to create 'tmp.sh' and then 'bash tmp.sh'. Which this plugin would allow, but would obviously let claude run anything. I've also had claude reach for awk '{system(...)}', which this plugin doesn't prevent, among some others. A blacklist of "unix commands which can execute arbitrary code" is doomed to failure because there's just so many ways out there to do so. Preventing destructive operations, like `rm -rf ~/`, is much more easily handled by running the agent in a container with only the code mounted into it, and then frequently committing changes and pushing them out of the container so that the agent can't delete its work history either. Half-measures, like trying to parse shell commands and flags, is just going to lead to the agent hitting a wall and looping into doing weird things (leading to it being more likely to really screw things up), as opposed to something like containers or VMs which are easy to use and actually work.
- ramoz 10mo ago
  I agree with this take. Esp with the simplicity of /sandbox I created the feature request for hooks so I could build an integrated governance capability. I don’t quite yet think the real use cases for hooks has materialized. Through a couple more maturity phases it will. Even though it might seem paradoxical with “the models will just get better” - to which is exactly why we have to be hooked into the mech suits as they'll end up doing more involved things. But I do pitch my initial , primitive, solution as “an early warning system” at best when used for security , but more so an actual way (opa/rego) to institute your own policies: https://github.com/eqtylab/cupcake https://github.com/eqtylab/cupcake https://cupcake.eqtylab.io/security-disclaimer/ https://cupcake.eqtylab.io/security-disclaimer/
  - SOLAR_FIELDS 10mo ago
BewareTheYiga 10mo ago
I am always surprised at how quick Claude will ask to run git filter-branch vs doing the same operation safely via an extra command or two.
- 112233 10mo ago
  Right? The training set must be insane. The way it heads/tails/greps to limit tokens ingested must have taken a lot to train — that's not something one finds on SO
hombre_fatal 10mo ago
Switching to plan mode for everything before the application step seems to avoid the problem. The problem seems to come when it’s stuck in a debug death loop with full permissions.
- deleted 10mo ago
  [deleted]
johnnyfived 10mo ago
Two MCP tools back to back on the HN frontpage when seemingly dozens of them doing the same functionality already exist. Both posts written by AI with the typical tells. Daring today aren't we?
- delusional 10mo ago
  AI slop articles taking over HN would be the best possible outcome, then maybe we could ban all of it.
  - throw-12-16 10mo ago
    You would end up banning 90% of the current YC crop.
    - throwaway314155 10mo ago
      And nothing of value would be lost.
MarsIronPI 10mo ago
Someone should write a version of this that uses AI to detect whether the command that the AI wants to run is dangerous. Certainly that seems like the current trend in software "engineering".
throw-12-16 10mo ago
Jesus. Just containerize Claude. How is this not common practice already? Are people really ok with a third party agent running out of their home directory executing arbitrary commands on their behalf? Pure insanity.
- viraptor 10mo ago
  That or setup a sandbox for paths you want / don't want touched.
vbernat 10mo ago
I am using something like this on Linux: bwrap --ro-bind /{,} --dev /dev --proc /proc --tmpfs /run --tmpfs /tmp --tmpfs /var/tmp --tmpfs ${HOME} --ro-bind ${HOME}/.nix-profile{,} --unshare-all --die-with-parent --tmpfs ${XDG_RUNTIME_DIR} --ro-bind /run/systemd/resolve/stub-resolv.conf{,} --share-net --bind ${HOME}/.config/claude-code{,} --overlay-src ${HOME}/.cache/go --tmp-overlay ${HOME}/.cache/go --bind ${PWD}{,} --ro-bind ${PWD}/.git{,} -- env SHELL=/bin/bash CLAUDE_CONFIG_DIR=${HOME}/.config/claude-code =claude
ivankra 10mo ago
Just put it in a container. I use bash aliases like this to start a throwaway container with bind mounted cwd, works like a charm with rootless podman. I also learned to run npm and other shady tools in this way and stopped worrying about supply chain attacks. alias dr='docker run --rm -it -v "$PWD:$PWD" -w "$PWD"' alias dr-claude='dr -v ~/.claude:/root/.claude -v ~/.claude.json:/root/.claude.json claude'
- Porygon 10mo ago
  I do that, too! I use git for version control outside the docker container, and to prevent claude from executing arbitrary code through commit hooks, I attach the docker volume mount in a nested directory of the repository so claude can not touch .git. Are there any other attack vectors that I should watch out for?
  - ivankra 10mo ago
    Ohh, good point about git hooks as a container escape vector! I probably should add `-v $PWD/.git:$PWD/.git:ro` for that (bind-mount .git as read-only).
  - throw-12-16 10mo ago
    I never mount .git to the agent container, but sometimes I will initialize the container with its own internal .git so the agent can preserve its git operations and maintain a change log outside of its memory context.
- ashishb 10mo ago
  I had the same setup that I posted about a few months back[1], and then I migrated all of it into a single tool[2] for ease of use. 1 - https://news.ycombinator.com/item?id=45766478 2 - http://github.com/ashishb/amazing-sandbox
- throw-12-16 10mo ago
  Same, I containerize all of my dev envs. I really struggle to understand how this isn't common best practice at this point. Especially when it comes to agents and anything node related. Claude is distributed as an npm global, so doubly true. Takes about 5 minutes to set this up.
raphinou 10mo ago
I always run my agents in a container with the source code directory mounted. That way I can reasonably be confident I may let it work without fearing destructive actions to my system. And I'm a git reset away to restore source code.
corv 10mo ago
I’ve been working on a different approach to this problem: syscall-level interception via PyPy sandbox rather than command filtering. This captures all operations at the OS level, so tmp.sh scripts and Makefile edits get queued for human review before executing. It’s still WIP but the core sandbox works. Feedback greatly appreciated: https://github.com/corv89/shannot https://github.com/corv89/shannot
bhouston 10mo ago
Sure, but I've written +150K lines of AI generated code myself and never seen it do a destructive command. Pretty much Cursor non-stop and my own agent before that.
- embedding-shape 10mo ago
  I've also used LLMs for coding a lot for the last two years or so, and never had anything like that happen either. Worst case has been an agent doing `git checkout -- $file` when I wasn't clear about how to undo something, and lost a bunch of other changes I had done. Nowadays each invocation of any agent happen in a completely new environment and git repository, and optionally merged into what I have on disk, so don't know how it is for others right now. But undeniably it seems to happen to others, for whatever reason, I'm guessing the context has gone on too long, and since they get dumber the longer the context are, eventually you're bound to get it to want to run some funky commands in confusion.
- fragmede 10mo ago
  I've also never been murdered before, but I'm pretty sure that's a real thing that happens too though. I've had both codex and Claude freak out and delete shit too, so it's a real thing! All I can really say is Pay for Arq backups/whatever if you're on a Mac to get some peace of mind.
eigenvalue 10mo ago
This sure looks similar to something I posted on X 2 weeks ago: https://github.com/Dicklesworthstone/misc_coding_agent_tips_and_scripts/blob/main/DESTRUCTIVE_GIT_COMMAND_CLAUDE_HOOKS_SETUP.md https://github.com/Dicklesworthstone/misc_coding_agent_tips_... You be the judge: https://x.com/doodlestein/status/2002423770259345451?s=46 https://x.com/doodlestein/status/2002423770259345451?s=46
- Dowwie 10mo ago
  Definitely too similar to be a coincidence
- hetspookjee 10mo ago
  Wow this readme reads so similar it rather unlikely a coincidence?
  - eigenvalue 10mo ago
    Yeah, I was being polite. This is outright plagiarism. @dang
    - throw-12-16 10mo ago
      "License: This repository contains documentation and configuration files. Use freely for personal or commercial projects."
      - eigenvalue 10mo ago
        You really think that's the same as someone blatantly plagiarizing the work and passing it off as their own? Give me a break. This is dishonest and odious.
        throw-12-16 10mo ago
        Its not about what I think, thats what the license says.

61 points by kenryu 11mo ago

You should probably rely less on AI. If your first thought is "I need to delete some directories" and your immediate next thought is "I'd better ask an AI agent to do this for me", you are definitely exhibiting skill entropy.

thrdbndndn 10mo ago
What is "skill entropy"
- intev 10mo ago
  They think it's a smart way to say that the o.p. is dumb.
  - WolfeReader 10mo ago
    Nope, skill atrophy can affect anyone at any level.
- itemize123 10mo ago
  atrophy?
- AdieuToLogic 10mo ago
  > What is "skill entropy" Skill entropy is a result of reliance on tools to perform tasks which otherwise would contribute to and/or reinforce a person's ability to master same. Without exercising one's acquired learning, skills can quickly fade. For example, an argument can be made that spellcheckers commonly available in programs degrade people's ability to spell correctly without this assistance (such as when using pen and paper).
- WolfeReader 10mo ago
  I did mean "atrophy" as others mentioned.
RogerL 10mo ago
Claude does these things even though you have explicit instructions not to do them, this isn't a tool for you asking it to delete files. Just today Claude decided to do a git restore on me, blowing away local changes, despite having strict instructions to do nothing with git except to use it to look at history and branches. Why jump to the conclusion that the person is so incompetent with no evidence?
- intev 10mo ago
  Because there's now a class of programmers who are very anti AI when it comes to coding because they think anybody who relies on it are degenerate vibe coders who have no idea what they are doing. You can see this in pretty much every single HN post w.r.t AI and coding.
  - WolfeReader 10mo ago
    There is indeed a class of programmers who think AI over-reliance will make us worse. And there should be, because it's true. https://www.mdpi.com/2075-4698/15/1/6 https://www.mdpi.com/2075-4698/15/1/6 https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4812513 https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4812513
    - blackqueeriroh 10mo ago
      Did you even read the abstracts of these papers? The first one has four important phrases: “negative correlation,” “mediated by increased cognitive offloading,” “higher educational attainment was associated with better critical thinking skills, regardless of AI usage,” and “potential costs.” The second paper has two: “students using GenAI tools score on average 6.71 (out of 100) points lower than non-users,” and “suggesting an effect whereby GenAI tool usage hinders learning.” I ask you, sir, where exactly do you get “AI over-reliance will make us worse…because it’s true” from TWO studies that go out of their way to make it clear there is no causative link, only correlation, point out significant mediations of the effect, identify only potentiality, and also show only half a letter grade difference, which when you’re dealing with students could be down to all sorts of things. Not to mention we’re dealing with one preprint and some truly confounding study design. If you don’t understand research methods, please stop presenting papers as if they are empirical authorities on truth. It diminishes trust in real academic work.
joshribakoff 10mo ago
Thanks for framing my physical disability as a skill issue. Injuries i sustained developing my skills beyond what most others were willing to do, but i guess my use of AI to assist my input so i can continue developing totally erases that experience.
- WolfeReader 10mo ago
  I can see that my comment about disabled users really got under your skin. How fortunate, then, that I never actually made such a comment.

TheDong 10mo ago

In my opinion this is a solution at the wrong layer. It's working by trying to filter executed commands, but it doesn't work in many cases (even in 'strict mode'), and there's better, more complete, solutions. What do I mean by "it doesn't work"? Well, claude code is really good at executing things in unusual ways when it needs to, and this is trying to parse shell to catch them. When claude code has trouble running a bash command, it sometimes will say something like "The current environment is wonky, let's put it in a file and run that", and then use the edit tool to create 'tmp.sh' and then 'bash tmp.sh'. Which this plugin would allow, but would obviously let claude run anything. I've also had claude reach for awk '{system(...)}', which this plugin doesn't prevent, among some others. A blacklist of "unix commands which can execute arbitrary code" is doomed to failure because there's just so many ways out there to do so. Preventing destructive operations, like `rm -rf ~/`, is much more easily handled by running the agent in a container with only the code mounted into it, and then frequently committing changes and pushing them out of the container so that the agent can't delete its work history either. Half-measures, like trying to parse shell commands and flags, is just going to lead to the agent hitting a wall and looping into doing weird things (leading to it being more likely to really screw things up), as opposed to something like containers or VMs which are easy to use and actually work.

ramoz 10mo ago
I agree with this take. Esp with the simplicity of /sandbox I created the feature request for hooks so I could build an integrated governance capability. I don’t quite yet think the real use cases for hooks has materialized. Through a couple more maturity phases it will. Even though it might seem paradoxical with “the models will just get better” - to which is exactly why we have to be hooked into the mech suits as they'll end up doing more involved things. But I do pitch my initial , primitive, solution as “an early warning system” at best when used for security , but more so an actual way (opa/rego) to institute your own policies: https://github.com/eqtylab/cupcake https://github.com/eqtylab/cupcake https://cupcake.eqtylab.io/security-disclaimer/ https://cupcake.eqtylab.io/security-disclaimer/
- SOLAR_FIELDS 10mo ago

BewareTheYiga 10mo ago

I am always surprised at how quick Claude will ask to run git filter-branch vs doing the same operation safely via an extra command or two.

112233 10mo ago
Right? The training set must be insane. The way it heads/tails/greps to limit tokens ingested must have taken a lot to train — that's not something one finds on SO

hombre_fatal 10mo ago

Switching to plan mode for everything before the application step seems to avoid the problem. The problem seems to come when it’s stuck in a debug death loop with full permissions.

deleted 10mo ago
[deleted]

johnnyfived 10mo ago

Two MCP tools back to back on the HN frontpage when seemingly dozens of them doing the same functionality already exist. Both posts written by AI with the typical tells. Daring today aren't we?

delusional 10mo ago
AI slop articles taking over HN would be the best possible outcome, then maybe we could ban all of it.
- throw-12-16 10mo ago
  You would end up banning 90% of the current YC crop.
  - throwaway314155 10mo ago
    And nothing of value would be lost.

MarsIronPI 10mo ago

Someone should write a version of this that uses AI to detect whether the command that the AI wants to run is dangerous. Certainly that seems like the current trend in software "engineering".

throw-12-16 10mo ago

Jesus. Just containerize Claude. How is this not common practice already? Are people really ok with a third party agent running out of their home directory executing arbitrary commands on their behalf? Pure insanity.

viraptor 10mo ago
That or setup a sandbox for paths you want / don't want touched.

vbernat 10mo ago

I am using something like this on Linux: bwrap --ro-bind /{,} --dev /dev --proc /proc --tmpfs /run --tmpfs /tmp --tmpfs /var/tmp --tmpfs ${HOME} --ro-bind ${HOME}/.nix-profile{,} --unshare-all --die-with-parent --tmpfs ${XDG_RUNTIME_DIR} --ro-bind /run/systemd/resolve/stub-resolv.conf{,} --share-net --bind ${HOME}/.config/claude-code{,} --overlay-src ${HOME}/.cache/go --tmp-overlay ${HOME}/.cache/go --bind ${PWD}{,} --ro-bind ${PWD}/.git{,} -- env SHELL=/bin/bash CLAUDE_CONFIG_DIR=${HOME}/.config/claude-code =claude

ivankra 10mo ago

Just put it in a container. I use bash aliases like this to start a throwaway container with bind mounted cwd, works like a charm with rootless podman. I also learned to run npm and other shady tools in this way and stopped worrying about supply chain attacks. alias dr='docker run --rm -it -v "$PWD:$PWD" -w "$PWD"' alias dr-claude='dr -v ~/.claude:/root/.claude -v ~/.claude.json:/root/.claude.json claude'

Porygon 10mo ago
I do that, too! I use git for version control outside the docker container, and to prevent claude from executing arbitrary code through commit hooks, I attach the docker volume mount in a nested directory of the repository so claude can not touch .git. Are there any other attack vectors that I should watch out for?
- ivankra 10mo ago
  Ohh, good point about git hooks as a container escape vector! I probably should add `-v $PWD/.git:$PWD/.git:ro` for that (bind-mount .git as read-only).
- throw-12-16 10mo ago
  I never mount .git to the agent container, but sometimes I will initialize the container with its own internal .git so the agent can preserve its git operations and maintain a change log outside of its memory context.
ashishb 10mo ago
I had the same setup that I posted about a few months back[1], and then I migrated all of it into a single tool[2] for ease of use. 1 - https://news.ycombinator.com/item?id=45766478 2 - http://github.com/ashishb/amazing-sandbox
throw-12-16 10mo ago
Same, I containerize all of my dev envs. I really struggle to understand how this isn't common best practice at this point. Especially when it comes to agents and anything node related. Claude is distributed as an npm global, so doubly true. Takes about 5 minutes to set this up.

raphinou 10mo ago

I always run my agents in a container with the source code directory mounted. That way I can reasonably be confident I may let it work without fearing destructive actions to my system. And I'm a git reset away to restore source code.

corv 10mo ago

I’ve been working on a different approach to this problem: syscall-level interception via PyPy sandbox rather than command filtering. This captures all operations at the OS level, so tmp.sh scripts and Makefile edits get queued for human review before executing. It’s still WIP but the core sandbox works. Feedback greatly appreciated: https://github.com/corv89/shannot https://github.com/corv89/shannot

bhouston 10mo ago

Sure, but I've written +150K lines of AI generated code myself and never seen it do a destructive command. Pretty much Cursor non-stop and my own agent before that.

embedding-shape 10mo ago
I've also used LLMs for coding a lot for the last two years or so, and never had anything like that happen either. Worst case has been an agent doing `git checkout -- $file` when I wasn't clear about how to undo something, and lost a bunch of other changes I had done. Nowadays each invocation of any agent happen in a completely new environment and git repository, and optionally merged into what I have on disk, so don't know how it is for others right now. But undeniably it seems to happen to others, for whatever reason, I'm guessing the context has gone on too long, and since they get dumber the longer the context are, eventually you're bound to get it to want to run some funky commands in confusion.
fragmede 10mo ago
I've also never been murdered before, but I'm pretty sure that's a real thing that happens too though. I've had both codex and Claude freak out and delete shit too, so it's a real thing! All I can really say is Pay for Arq backups/whatever if you're on a Mac to get some peace of mind.

eigenvalue 10mo ago

This sure looks similar to something I posted on X 2 weeks ago: https://github.com/Dicklesworthstone/misc_coding_agent_tips_and_scripts/blob/main/DESTRUCTIVE_GIT_COMMAND_CLAUDE_HOOKS_SETUP.md https://github.com/Dicklesworthstone/misc_coding_agent_tips_... You be the judge: https://x.com/doodlestein/status/2002423770259345451?s=46 https://x.com/doodlestein/status/2002423770259345451?s=46

Dowwie 10mo ago
Definitely too similar to be a coincidence
hetspookjee 10mo ago
Wow this readme reads so similar it rather unlikely a coincidence?
- eigenvalue 10mo ago
  Yeah, I was being polite. This is outright plagiarism. @dang
  - throw-12-16 10mo ago
    "License: This repository contains documentation and configuration files. Use freely for personal or commercial projects."
    - eigenvalue 10mo ago
      You really think that's the same as someone blatantly plagiarizing the work and passing it off as their own? Give me a break. This is dishonest and odious.
      - throw-12-16 10mo ago
        Its not about what I think, thats what the license says.