Prevent Claude Code rm -rf Disasters

Claude Code has full terminal access. It can — and has — run rm -rf / and deleted entire filesystems. These aren't hypothetical risks. They're real incidents reported on GitHub.

Real Incidents

Why CLAUDE.md Can't Prevent This

CLAUDE.md rules are part of the prompt context. When context fills up, rules get pushed out. Claude can (and does) ignore them. A rule saying "never run rm -rf" is a suggestion, not enforcement.

The Fix: PreToolUse Hooks

Claude Code Hooks run at the process level, outside the model's control. A PreToolUse hook that exits with code 2 blocks the tool invocation. The model cannot ignore the block or argue its way past it.

#!/bin/bash
INPUT=$(cat)
COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty')

# A shell joins "\" + newline before running the command. grep is line-oriented,
# so without this it sees `rm -rf \` and `/` as two separate lines and matches
# neither. That is not an exotic way to write a command -- it is what you get
# from wrapping a long line.
COMMAND=${COMMAND//\\$'\n'/ }

# Question 1: is this a recursive delete? Short flags can be bundled and
# reordered (-rf, -fr, -Rf), and there is a long spelling too.
RECURSIVE='(^|[;&|]|&&|\|\|)[[:space:]]*(sudo[[:space:]]+)?rm[[:space:]]+([^|;&]*[[:space:]])?(-[a-zA-Z]*[rR][a-zA-Z]*[[:space:]]|--recursive[[:space:]])'

# Question 2: is the target somewhere you cannot undo?
#   / ~ $HOME       everything underneath is dangerous too
#   . .. ./ *       dangerous only when the argument IS that, so read to the end
#                   of the argument -- otherwise `rm -rf ./node_modules` is caught
DANGEROUS='[[:space:]]["'"'"']?(/|~|\$\{?HOME\}?)|[[:space:]]["'"'"']?(\.\.?/?|\*)(["'"'"']?[[:space:]]|["'"'"']?$)'

if printf '%s' "$COMMAND" | grep -qE "$RECURSIVE" &&
   printf '%s' "$COMMAND" | grep -qE "$DANGEROUS"; then
  echo "BLOCKED: recursive delete targeting root, home, or the current directory" >&2
  exit 2
fi

exit 0

Asking the two questions separately is the point. Folded into one expression, every new spelling has to be threaded through the whole pattern, and the pattern stops being readable long before it stops being wrong.

Where this rule stops

The block is solid. The pattern is a different thing, and it is worth knowing where it ends before you rely on it.

• Mentions. This compact version blocks a command that only appears inside echo or a heredoc. The shipped hook separates mentions from invocations before any rule runs.
• Other ways to delete. find . -delete, shred, git clean -fdx, a Python script — none of them are rm.
• The command name written another way, such as /bin/rm or a shell alias.
• A variable that expands into the target. rm -rf "$DIR" is only dangerous once you know what $DIR holds, and the hook sees the text, not the value.

If you need a guarantee rather than a good local filter, put the files somewhere the process cannot reach: a separate user account, a container, or a sandbox. A hook filters what gets typed. It cannot make a directory unreachable.

This pattern was rewritten on 2026-09-03. The version this page carried before it missed six real cases — a line-wrapped rm -rf /, rm -rf "$HOME", rm --recursive --force /, rm -rf ./, cd / && rm -rf * — and the line-wrapped one is the one worth pausing on: the textbook example still got blocked, so the gap looked like coverage. Both directions are covered by 31 cases now.

npx github:yurukusa/cc-safe-setup

Verify Your Setup

npx github:yurukusa/cc-safe-setup --verify

Sends test inputs to each hook and confirms they block correctly:

destructive-guard:
  ✔ rm -rf / → BLOCKED
  ✔ rm -rf node_modules → ALLOWED
8/8 hooks verified

Check Your Safety Score

npx cc-health-check

Free 20-point diagnostic. Score below 80 means your Claude Code setup has gaps.

cc-safe-setup is open source, no npm dependencies (needs jq), and installs nothing globally. All hooks run locally. View source on GitHub.

New: Hook if field — reduce overhead (v2.1.85)

Learn more: Production Guide · All Tools