What does this skill do, and when should you use it?
CC Safety Net is a PreToolUse hook that analyzes and blocks destructive Git and filesystem operations before an AI coding agent runs them. It supports Claude Code, Codex, Gemini CLI, GitHub Copilot CLI, Kimi Code, OpenCode, and Pi on Windows, macOS, and Linux. The analyzer evaluates command semantics, including shell wrappers and interpreter one-liners. It is a fit for teams that need hard command controls, audit logs, and custom rules around AI-assisted development.
Intercepts commands from AI coding agents and analyzes operations such as rm, git reset --hard, git checkout --, git push --force, git stash clear, git clean -f, find -delete, dd, mkfs, and shred; recursively inspects wrappers such as bash -c and sh -c up to 10 levels; checks destructive code in python -c, node -e, ruby -e, and perl -e one-liners; blocks malformed input, unparseable commands in strict mode, invalid configuration, and broken rulebooks according to its fail-closed behavior; reads user- or project-scoped rulebooks; and writes blocked commands to ~/.cc-safety-net/logs/<session_id>.jsonl with secrets automatically redacted.
- A Claude Code or Codex user working in a real repository who wants to prevent rm -rf and git reset --hard mistakes.
- A team using a workspace-writable sandbox that also needs protection against Git discards, force pushes, and directory deletion.
- An engineering organization that wants consistent destructive-command checks across Windows, macOS, and Linux.
- A maintainer who needs user- or project-scoped custom blocking rules through rulebooks.
- A team that needs session-level audit records of commands blocked by an AI coding agent.
How do you install this skill?
- The workflow executes unpinned `npx -y cc-safety-net`; verify package provenance, version, and network availability before use.
- The skill modifies user or project rule configuration; review the proposed JSON and retain a recoverable backup before writing.
- Static evidence does not prove that the custom-rule paths and validation flow work in the target environment.
- Fail-closed behavior is not a complete security boundary; combine it with sandboxing, permission controls, and version pinning.
- Shell / CLI
- Network access
- Local filesystem
Node.js 18 or higher
The skill path is not provided, and SKILL.md is not cached; the README documents CLI-specific installation instead. For Codex, enable [features] plugin_hooks = true in ~/.codex/config.toml, run codex plugin marketplace add kenryu42/cc-marketplace, start Codex, run /plugins in the TUI, select [cc-marketplace] and install the plugin, then run /hooks, select the safety-net PreToolUse hook, and press t to trust it. For Claude Code, run /plugin marketplace add kenryu42/cc-marketplace, /plugin install safety-net@cc-marketplace, and /reload-plugins. For Gemini CLI, run gemini extensions install https://github.com/kenryu42/gemini-safety-net. For Copilot CLI, run /plugin install kenryu42/copilot-safety-net. For Kimi Code, run npx -y cc-safety-net hook install --kimi-code. For OpenCode, run opencode plugin -g cc-safety-net. For Pi, run pi install npm:cc-safety-net.
tmp="$(mktemp -d)"
git clone --depth 1 https://github.com/kenryu42/cc-safety-net.git "$tmp"
mkdir -p ~/.claude/skills
cp -R "$tmp/skills/cc-safety-net" ~/.claude/skills/
rm -rf "$tmp"Generated from the source repository and skill path; it copies only this skill's folder. If the author's install steps above differ, follow those first. To scope it to one project, replace ~/.claude/skills with that project's .claude/skills.
How do you use this skill?
Once installed, send your agent any of these to trigger it:
- git reset --hard
After installing and enabling the integration for the target CLI, use the agent normally; the hook analyzes commands automatically. Run npx cc-safety-net doctor to verify the installation and run a self-test, or npx cc-safety-net explain "git reset --hard" to inspect the analysis trace. Both commands support --json. Modes can be adjusted with CC_SAFETY_NET_STRICT=1, CC_SAFETY_NET_PARANOID=1, CC_SAFETY_NET_PARANOID_RM=1, CC_SAFETY_NET_PARANOID_INTERPRETERS=1, and CC_SAFETY_NET_WORKTREE=1.
What are this skill's strengths and limitations?
- Semantic analysis covers flag reordering, shell wrappers, and interpreter one-liners.
- Fail-closed behavior blocks malformed input, unparseable commands, invalid configuration, and broken rulebooks in the documented cases.
- Supports seven AI coding-agent CLIs and Windows, macOS, and Linux.
- Provides custom rulebooks, SHA-256-pinned GitHub rule sources, and automatically redacted audit logs.
- Licensed under MIT.
- Requires Node.js 18 or higher.
- Some installation and configuration steps are CLI-specific; the README does not establish a generic Agent Skill folder installation path.
- It is not a complete sandbox; the README recommends using it together with sandboxing.
- Strict mode may block commands that cannot be parsed, and OpenCode may retain a stale cached plugin version.
- SKILL.md is not cached, so its exact frontmatter, body, and standard skill-directory structure cannot be verified.
How does this skill compare with similar options?
Side by side with related skills; every score comes from the same FSRS standard.
| Skill | FS score | Stars | Last updated | License |
|---|---|---|---|---|
| CC Safety Net Command Guard this page | 53 · Use with care | ★ 1.6k | 11d ago | MIT |
| ce-debug: Systematic Bug Diagnosis & Fix | 55 · Use with care | ★ 26k | 11d ago | MIT |
| Codeagent Multi-Backend Orchestration Skill | 51 · Use with care | ★ 2.8k | 5mo ago | AGPL-3.0 |
| Azure Queue Storage TypeScript Skill ✓ Microsoft · Official | 48 · Use with care | ★ 2.7k | 3mo ago | MIT |
| M365 Agents Toolkit Installer ✓ Microsoft · Official | 44 · Not recommended | ★ 2.7k | 3mo ago | MIT |
Compared with a workspace-writable sandbox, CC Safety Net addresses operations that a sandbox may still permit inside the project, including git reset --hard, git push --force, and rm -rf. Sandboxing limits the writable area, while CC Safety Net blocks destructive operations; the README recommends using both for defense in depth.
How did FollowSkills review this skill?
The workflow requires previewing new or merged JSON, preserving unrelated configuration, validating changes, restricting custom rules to additive protections, and failing closed on invalid configuration. These support least-privilege and recovery awareness. Points are deducted because it repeatedly runs `npx -y` to fetch and execute an unpinned external package, lacks an explicit final confirmation before writes, gives no complete rollback procedure, and has unverified publisher identity.
The evidence shows a structured process for obtaining schema documentation, inspecting existing configuration, generating rules, syncing, verifying, testing, listing, and displaying exact failures, with clear scope and merge requirements. Points are deducted because operation depends on network access, Node.js/npx, and package availability; no command output is statically reproducible here, key rule paths are not directly exercised in the provided evidence, and handling of unavailable tools or abnormal inputs is incomplete.
The skill clearly targets CC Safety Net rule configuration for user, project, and shareable GitHub scopes, covering add, edit, disable, migration, and explanation scenarios with distinct local and shared paths. Points are deducted because trigger boundaries and non-fit cases remain broad, no input/output templates are given, Chinese-language support is unsubstantiated, and the npx plus GitHub-based workflow may face mainland-China network reachability constraints.
The skill provides a readable workflow, rule constraints, scope guidance, migration instructions, and validation checklist; repository evidence also supplies an MIT license, security policy, version, CI, and documentation entry points. Points are deducted because the skill itself lacks versioning, changelog, maintenance ownership, or update-path details, while dependency behavior and troubleshooting are delegated mainly to remote `rule doc` output and examples are sparse.
The evidence indicates that the skill can translate user intent into valid rulebook JSON, edit the appropriate files, and run synchronization, verification, and tests, so its core configuration value is clear. Points are deducted because static review cannot confirm that commands generate correct configurations across cases; results depend on the external CLI documentation and network, and users may still need to resolve errors not concretely anticipated by the skill.
Evidence includes revision-pinned source material, README capability claims, CI workflows, and committed tests, providing some auditability. Points are deducted because the supplied tests focus on statusline behavior and CLI routing rather than the skill's rule-configuration workflow; no commands were executed and no independent or third-party reproduction evidence is provided.
Open a dimension to read why it scored that way
Evidence confidence：Low — Mostly static review, author material or a limited demo; useful for discovery, not high-risk decisions.
See the full review method →