Deny Bash(git add -A*), Bash(git add --all*), and Bash(git add .) so the bulk-stage forms can't run; deny overrides the existing git add * allow. The git-commit skill mandates specific-path staging, and a shared working tree makes -A actively dangerous (it sweeps another agent's files into the commit). Exact-match the bare dot rather than git add .* so git add .gitignore and other dotfile paths still work. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>