shell-guard-bench exposes Claude Code guard bypass: 31.9% blocked

The team's guard is designed to stop deletion outside the project and irreversible Git operations through Claude Code's PreToolUse hook, with separate Windows and Mac builds. All of its own automated tests passed, but those tests were written by the same people who wrote the guard, so they only covered command forms the authors had imagined. Turning to shell-guard-bench, a third-party collection of 89 shell command cases, produced a very different picture: the guard stopped less than a third of the dangerous commands overall, largely because the bench also tests areas the guard was never designed for, such as process killing, remote sync, databases, deployment, and commands that hang. When the team narrowed the comparison to its intended scope of deletion and Git, the guard blocked 21 of 27 dangerous commands and all 20 critical ones, with just one over-block on a force-push command deliberately set to confirm. The three real bypasses all involved hiding the rm command name through quoting, variable substitution, or base64 encoding; the team says it had not considered such deliberately obfuscated forms because its tests only modeled accidental AI mistakes. The same testing effort also surfaced smaller inconsistencies, such as a find ~ -mindepth 1 -delete command that was only set to confirm rather than deny, and two sudo commands the Windows build let through because it lacked chmod/chown handling. The authors have since released v1.5, which normalizes quotes in command names, sets variable command names and pipes into shells to confirm, denies find -delete and -exec rm outside the project, and brings Windows to parity with Mac, while their own test suites now total 181 cases on Windows and 161 on Mac, all passing.