diff --git a/claudetool/bashkit/bashkit.go b/claudetool/bashkit/bashkit.go
index 8e67a3b..23dc1b4 100644
--- a/claudetool/bashkit/bashkit.go
+++ b/claudetool/bashkit/bashkit.go
@@ -9,6 +9,7 @@
 
 var checks = []func(*syntax.CallExpr) error{
 	noGitConfigUsernameEmailChanges,
+	noBlindGitAdd,
 }
 
 // Check inspects bashScript and returns an error if it ought not be executed.
@@ -124,6 +125,48 @@
 	return willCommit, nil
 }
 
+// noBlindGitAdd checks for git add commands that blindly add all files.
+// It rejects patterns like 'git add -A', 'git add .', 'git add --all', 'git add *'.
+func noBlindGitAdd(cmd *syntax.CallExpr) error {
+	if hasBlindGitAdd(cmd) {
+		return fmt.Errorf("permission denied: blind git add commands (git add -A, git add ., git add --all, git add *) are not allowed, specify files explicitly")
+	}
+	return nil
+}
+
+func hasBlindGitAdd(cmd *syntax.CallExpr) bool {
+	if len(cmd.Args) < 2 {
+		return false
+	}
+	if cmd.Args[0].Lit() != "git" {
+		return false
+	}
+
+	// Find the 'add' subcommand
+	addIndex := -1
+	for i, arg := range cmd.Args {
+		if arg.Lit() == "add" {
+			addIndex = i
+			break
+		}
+	}
+
+	if addIndex < 0 {
+		return false
+	}
+
+	// Check arguments after 'add' for blind patterns
+	for i := addIndex + 1; i < len(cmd.Args); i++ {
+		arg := cmd.Args[i].Lit()
+		// Check for blind add patterns
+		if arg == "-A" || arg == "--all" || arg == "." || arg == "*" {
+			return true
+		}
+	}
+
+	return false
+}
+
 // isGitCommitCommand checks if a command is 'git commit'.
 func isGitCommitCommand(cmd *syntax.CallExpr) bool {
 	if len(cmd.Args) < 2 {
diff --git a/claudetool/bashkit/bashkit_test.go b/claudetool/bashkit/bashkit_test.go
index ea6e599..706790d 100644
--- a/claudetool/bashkit/bashkit_test.go
+++ b/claudetool/bashkit/bashkit_test.go
@@ -92,6 +92,91 @@
 			wantErr:  false,
 			errMatch: "",
 		},
+		// Git add validation tests
+		{
+			name:     "git add with -A flag",
+			script:   "git add -A",
+			wantErr:  true,
+			errMatch: "blind git add commands",
+		},
+		{
+			name:     "git add with --all flag",
+			script:   "git add --all",
+			wantErr:  true,
+			errMatch: "blind git add commands",
+		},
+		{
+			name:     "git add with dot",
+			script:   "git add .",
+			wantErr:  true,
+			errMatch: "blind git add commands",
+		},
+		{
+			name:     "git add with asterisk",
+			script:   "git add *",
+			wantErr:  true,
+			errMatch: "blind git add commands",
+		},
+		{
+			name:     "git add with multiple flags including -A",
+			script:   "git add -v -A",
+			wantErr:  true,
+			errMatch: "blind git add commands",
+		},
+		{
+			name:     "git add with specific file",
+			script:   "git add main.go",
+			wantErr:  false,
+			errMatch: "",
+		},
+		{
+			name:     "git add with multiple specific files",
+			script:   "git add main.go utils.go",
+			wantErr:  false,
+			errMatch: "",
+		},
+		{
+			name:     "git add with directory path",
+			script:   "git add src/main.go",
+			wantErr:  false,
+			errMatch: "",
+		},
+		{
+			name:     "git add with git flags before add",
+			script:   "git -C /path/to/repo add -A",
+			wantErr:  true,
+			errMatch: "blind git add commands",
+		},
+		{
+			name:     "git add with valid flags",
+			script:   "git add -v main.go",
+			wantErr:  false,
+			errMatch: "",
+		},
+		{
+			name:     "git command without add",
+			script:   "git status",
+			wantErr:  false,
+			errMatch: "",
+		},
+		{
+			name:     "multiline script with blind git add",
+			script:   "echo 'Adding files' && git add -A && git commit -m 'Update'",
+			wantErr:  true,
+			errMatch: "blind git add commands",
+		},
+		{
+			name:     "git add with pattern that looks like blind but is specific",
+			script:   "git add file.A",
+			wantErr:  false,
+			errMatch: "",
+		},
+		{
+			name:     "commented blind git add",
+			script:   "# git add -A",
+			wantErr:  false,
+			errMatch: "",
+		},
 	}
 
 	for _, tc := range tests {