careful

An agent skill by garrytan, from garrytan/gstack. Tags: security, validation, workflow.

What it does

Safety guardrails for destructive commands. (gstack)

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add garrytan/gstack --skill careful

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/garrytan/gstack
cp -r gstack/careful ~/.claude/skills/careful

Safety box score

Grade C, moderate risk: 25 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill installs a session hook that runs before every Bash and PowerShell command, then shells out to helpers to inspect commands for destructive patterns. The main risks are broad code-execution surface, writes to the user’s home-area gstack state, and the fact that its protection is advisory rather than an absolute boundary.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	3 (high)	It wires `bash -c "exec bash .../check-careful.sh"` into PreToolUse for Bash and PowerShell, and the hook itself invokes `python3`, `node`, `git`, `find`, `sed`, and `eval` (`eval "$($_HOOK_DIR/../../bin/gstack-slug ...)"`).
Network access	0 (none)	No file downloads or remote uploads are implemented; network-looking text such as `curl\|sh` appears only in comments and match logic.
Filesystem reach	2 (moderate)	It reads and writes outside the project tree in `$HOME/.gstack`/`$GSTACK_STATE_ROOT`, including `analytics/skill-usage.jsonl` and optional `careful-patterns.txt` files.
Secrets & credentials	0 (none)	The reviewed files do not access keychains, token stores, browser sessions, `.env` files, or other secret locations.
Privilege & persistence	0 (none)	There is no sudo, service registration, global install, or shell-startup editing in the reviewed code.
Instruction hijack surface	0 (none)	I did not find hidden prompts, fetched instructions, or other prompt-injection style directives in the skill files.
Irreversible actions	1 (low)	Its purpose is to gate local shell actions, so it can ask/deny commands, but it does not itself push, delete, deploy, or publish anything.
Transparency	1 (low)	Some behavior depends on sibling helpers not included in the reviewed files (`../../bin/gstack-state-root.sh`, `../../bin/gstack-slug`), and one path executes helper output with `eval`.

Before installing

Read `bin/check-careful.sh` around the `eval "$($_HOOK_DIR/../../bin/gstack-slug ...)"` line and confirm that helper is trusted.
Check whether creating and updating `~/.gstack/analytics/skill-usage.jsonl` is acceptable in your home directory.
Test the hook in a scratch session with a harmless Bash command and verify the warnings/denials behave as expected on your platform.

Rated 2026-10-16 by an automated review of 3 files from the skill's repository.

Source

Repository: garrytan/gstack (all skills from this repository)
Path: careful/SKILL.md
Branch: main
Updated: 2026-10-05

guard — Full safety mode: destructive command warnings + directory-scoped edits. (gstack)
marketplace-health-check — Run a full 6-dimension health check of this Claude Code skills marketplace repo — code/script safety, documentation/SSOT consistency, security/PII leaks.
agents-harden — Use when preparing your agent for production — IAM scoping, inbound auth (JWT, SigV4), secrets management, cold start optimization, session lifecycle.
agents-pay — Use when THIS agent needs to pay for x402-protected content at runtime: hitting a paywall mid-task, settling it via AgentCore Payments.
aws-cloudformation — Authors, validates, and troubleshoots AWS CloudFormation templates.
aws-iam — Provides verified corrections for IAM behaviors that AI agents frequently get wrong — policy evaluation edge cases, trust policy gotchas, STS session limits.