All Three Skills That Mention rm -rf Are Guarded

This is the follow-up to the previous post: string matching finds suspects, reading finds answers.

Three skills out of 765 contain the string rm -rf. Here is what each one actually does.

1. A rule, not a command

i-have-adhd mentions it in a list of exceptions:

> Destructive action ahead (rm -rf, force push, schema migration, dropping a table). Confirm before acting. Safety wins over brevity.

The skill is a communication-style guide. It names rm -rf as the canonical example of an action that should interrupt the style rules and trigger confirmation. There is no command to execute.

2. A scoped cleanup

understand-figma, from the Understand-Anything toolkit, deletes intermediate files after building a design graph:

INTER="$UA_DIR/intermediate"
find "$INTER" -mindepth 1 -maxdepth 1 \
  -not -name 'scan-manifest.json' -exec rm -rf {} +

Three properties make this safe:

• The target is a per-project working directory, not a user path.
• -mindepth 1 prevents the command from matching the directory itself.
• -not -name preserves the manifest that the next phase needs.

It is still a recursive delete. But the blast radius is defined by a variable the skill controls, not by whatever the user typed.

3. An explicit guard against the classic failure

understand-knowledge uses the same cleanup pattern and adds the check that most scripts omit:

TARGET_DIR="<TARGET_DIR>"
UA_DIR="$TARGET_DIR/$([ -d "$TARGET_DIR/.understand-anything" ] \
  && echo .understand-anything || echo .ua)"
if [ -n "$TARGET_DIR" ] && [ -d "$UA_DIR/intermediate" ]; then
  rm -rf "$UA_DIR/intermediate"
fi

The comment above it names the exact hazard:

> Resolve $UA_DIR into a shell variable and guard it so an empty or unresolved path can never expand to rm -rf /intermediate.

This is the difference between a command that is safe in testing and one that is safe when a variable is unset, a mount is missing, or the working directory is /. The check costs one line.

What the scan cannot see

We only scanned the text of SKILL.md files. Many skills reference scripts in scripts/; those files were not scanned, so the true count of rm -rf in the ecosystem is higher. The three above are the mentions that appear in the instructions an agent reads directly.

A pattern worth copying

If a skill must delete recursively, the safe shape is consistent:

1. Scope the path to a directory the skill owns.
2. Check it is non-empty and exists before expanding it.
3. Preserve what you need with an explicit exclusion.
4. Say when to confirm if the target is user-supplied.

Three skills in this corpus do this. That is a small sample, but a good template — and a much better outcome than the raw count suggested.