Customize damage-control protection patterns for your project. Creates local pattern overrides based on project context. Use when user wants to adjust protection rules, allow specific commands, or customize path protection for their project needs.
From damage-controlnpx claudepluginhub app-vitals/marketplace --plugin damage-controlThis skill uses the workspace's default tool permissions.
Searches, retrieves, and installs Agent Skills from prompts.chat registry using MCP tools like search_skills and get_skill. Activates for finding skills, browsing catalogs, or extending Claude.
Searches prompts.chat for AI prompt templates by keyword or category, retrieves by ID with variable handling, and improves prompts via AI. Use for discovering or enhancing prompts.
Compares coding agents like Claude Code and Aider on custom YAML-defined codebase tasks using git worktrees, measuring pass rate, cost, time, and consistency.
Help users create project-specific pattern overrides that balance security with their workflow needs.
The damage-control plugin works immediately with default patterns. This skill helps users customize those patterns when:
Pattern Priority:
.claude/hooks/damage-control/patterns.yaml (project override - this skill creates this)patterns.yaml (fallback)Hooks automatically check for project override first, making customization safe and reversible.
Check if override already exists:
ls -la .claude/hooks/damage-control/patterns.yaml
If exists:
.claude/hooks/damage-control/patterns.yaml"If not exists:
Get plugin default location:
${CLAUDE_PLUGIN_ROOT}/hooks/patterns.yaml# Find the plugin
/plugin list
# Copy patterns (user will need to substitute actual path)
mkdir -p .claude/hooks/damage-control
cp <damage-control-plugin-path>/hooks/patterns.yaml .claude/hooks/damage-control/patterns.yaml
If you can determine plugin root, copy directly:
mkdir -p .claude/hooks/damage-control
cp ${CLAUDE_PLUGIN_ROOT}/hooks/patterns.yaml .claude/hooks/damage-control/patterns.yaml
Scan project to understand what might need customization:
Common patterns by project type:
AWS/Cloud Projects:
*.env pattern uses word boundaries and won't match "environment" in commands like aws ecs describe-tasks --query 'tasks[0].containers[0].environment'Database Projects:
ask: trueMonorepo/Build Systems:
rm -rf blocking prevents cleanupBased on project analysis, suggest specific edits to the user.
Example suggestions:
"I noticed you have multiple environment-specific config files. Consider making your zero-access patterns more specific to your project structure:"
# Example: Project-specific .env protection
zeroAccessPaths:
- ".env"
- ".env.local"
- ".env.production"
- ".env.staging"
- "config/secrets.yml" # Add project-specific secret files
"I see you have a SQLite database. Consider changing DELETE protection from blocking to asking:"
# Before (blocks all):
bashToolPatterns:
- pattern: 'DELETE\s+FROM\s+\w+\s*;'
reason: DELETE without WHERE clause
# After (ask for confirmation):
bashToolPatterns:
- pattern: 'DELETE\s+FROM\s+\w+\s+WHERE\b'
reason: DELETE with WHERE clause
ask: true
Present clear steps:
.claude/hooks/damage-control/patterns.yamlzeroAccessPaths (or relevant section)[old pattern][new pattern]Test patterns by calling hooks directly:
# Test bash hook blocks dangerous command (expect exit code 2)
echo '{"tool_name":"Bash","tool_input":{"command":"rm -rf /"}}' | \
uv run ${CLAUDE_PLUGIN_ROOT}/hooks/bash-tool-damage-control.py
echo "Exit code: $?" # Should be 2 (blocked)
# Test bash hook allows safe command (expect exit code 0)
echo '{"tool_name":"Bash","tool_input":{"command":"ls -la"}}' | \
uv run ${CLAUDE_PLUGIN_ROOT}/hooks/bash-tool-damage-control.py
echo "Exit code: $?" # Should be 0 (allowed)
# Test edit hook blocks zero-access path (expect exit code 2)
echo '{"tool_name":"Edit","tool_input":{"file_path":"~/.ssh/id_rsa"}}' | \
uv run ${CLAUDE_PLUGIN_ROOT}/hooks/edit-tool-damage-control.py
echo "Exit code: $?" # Should be 2 (blocked)
# Test write hook blocks zero-access path (expect exit code 2)
echo '{"tool_name":"Write","tool_input":{"file_path":".env"}}' | \
uv run ${CLAUDE_PLUGIN_ROOT}/hooks/write-tool-damage-control.py
echo "Exit code: $?" # Should be 2 (blocked)
Exit codes:
0 = Allowed (command proceeds)2 = Blocked (error message in stderr)Test after each change:
Repeat Steps 5-6 for each pattern that needs adjustment:
Hook testing is safe - hooks validate patterns but don't execute commands
Block or ask for confirmation on bash commands:
bashToolPatterns:
# Block entirely (default)
- pattern: '\brm\s+-[rRf]'
reason: rm with recursive or force flags
# Ask for confirmation
- pattern: '\bgit\s+push\s+\S+\s+--delete'
reason: Deletes remote branch
ask: true
zeroAccessPaths - No access at all (secrets/credentials):
zeroAccessPaths:
- "~/.ssh/"
- "*.pem"
- ".env*"
readOnlyPaths - Read allowed, modifications blocked:
readOnlyPaths:
- "package-lock.json"
- "/etc/"
- "*.lock"
noDeletePaths - All operations except delete:
noDeletePaths:
- "README.md"
- ".git/"
- "CLAUDE.md"
Supports:
*.ext - Files with extensionprefix* - Files starting with prefix.env* - Files starting with .env**/*.ext - Recursive patternNote: The *.env pattern uses word boundaries, so it won't block commands containing "environment" as part of JSON paths or query outputs. However, you may want to customize patterns for your specific project structure.
Example customization:
zeroAccessPaths:
# Default includes "*.env" which blocks files ending in .env
# Customize for your project's naming conventions:
- ".env"
- ".env.local"
- ".env.production"
- ".env.staging"
- "config/secrets.yml" # Add project-specific paths
Problem: rm -rf build/ blocked by blanket rm -rf protection
Solution:
bashToolPatterns:
# Keep general protection
- pattern: '\brm\s+-[rRf].*(/|~|\$HOME|/usr|/etc)'
reason: rm -rf on dangerous paths
# Remove: '\brm\s+-[rRf]' (too broad)
Problem: All DELETE commands blocked, even safe ones
Solution:
bashToolPatterns:
# Block dangerous (no WHERE)
- pattern: 'DELETE\s+FROM\s+\w+\s*;'
reason: DELETE without WHERE clause
# Ask for safe (with WHERE)
- pattern: 'DELETE\s+FROM\s+\w+\s+WHERE\b'
reason: DELETE with WHERE clause
ask: true
If customizations break protection:
Restore defaults:
rm .claude/hooks/damage-control/patterns.yaml
# Hooks will fall back to plugin default
Compare with default:
diff .claude/hooks/damage-control/patterns.yaml <plugin-path>/hooks/patterns.yaml
pattern to include ask: true rather than removing it entirely<plugin-path>/hooks/patterns.yaml.claude/hooks/damage-control/patterns.yaml