 yurukusa
|
aa977104c9
|
fix: address P1 review issues from cubic-dev-ai
1. Python one-liner: detect version-suffixed executables (python3.11, python3.12)
Pattern: python[23]? → python[23]?(\.[0-9]+)?
2. Pipe-to-shell: detect shell invocations with arguments (| sh -s, | bash -c)
Pattern: \|\s*(sh|bash|zsh)\s*$ → (\s|$)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
2026-04-13 20:44:36 +09:00 |
|
|
yurukusa
|
5299c0c18d
|
Add shell-wrapper-guard hook to security category
Detects destructive commands hidden in shell wrappers (sh -c, bash -c,
python3 -c, node -e, etc). Complements dangerous-command-blocker by
catching 8 bypass vectors that evade direct command checks.
From cc-safe-setup (667 hooks, 9,200+ tests, 800hrs autonomous operation).
https://github.com/yurukusa/cc-safe-setup
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
2026-04-13 17:45:08 +09:00 |
|