mirror of
https://github.com/davila7/claude-code-templates.git
synced 2026-09-19 01:30:23 +08:00
yurukusa
5299c0c18d
Detects destructive commands hidden in shell wrappers (sh -c, bash -c, python3 -c, node -e, etc). Complements dangerous-command-blocker by catching 8 bypass vectors that evade direct command checks. From cc-safe-setup (667 hooks, 9,200+ tests, 800hrs autonomous operation). https://github.com/yurukusa/cc-safe-setup Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
24 lines
789 B
JSON
24 lines
789 B
JSON
{
|
|
"description": "Detects destructive commands hidden inside shell wrappers (sh -c, bash -c, python3 -c, node -e, perl -e, ruby -e). Complements dangerous-command-blocker by catching bypass vectors like 'sh -c \"rm -rf /\"' that evade direct command checks. Covers 8 bypass patterns: interpreter one-liners, nested wrappers, pipe-to-shell, here-strings, and env-based wrappers.",
|
|
"supportingFiles": [
|
|
{
|
|
"source": "shell-wrapper-guard.sh",
|
|
"destination": ".claude/hooks/shell-wrapper-guard.sh",
|
|
"executable": true
|
|
}
|
|
],
|
|
"hooks": {
|
|
"PreToolUse": [
|
|
{
|
|
"matcher": "Bash",
|
|
"hooks": [
|
|
{
|
|
"type": "command",
|
|
"command": "bash .claude/hooks/shell-wrapper-guard.sh"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|