How Claude Code's PreToolUse Hooks Can Block Dangerous Shell Commands

Claude Code's ability to run tools introduces risk, as prompt-based instructions alone can be unreliable guardrails. Developers can use a PreToolUse hook — a script that runs before any tool call — to programmatically intercept and block dangerous commands like 'rm -rf'. The hook works by inspecting incoming Bash commands and returning exit code 2 to block execution, while exit code 0 signals no objection. A sample implementation uses a shell script paired with a settings.json configuration file placed inside the project's .claude directory. Developers are cautioned that hooks are a supplementary safety layer and should be combined with permission rules, sandboxing, and backups for high-stakes environments.