Claude Code Security Hooks

Claude Code Security Hooks

7 layers of defense against prompt injection in Claude Code.

Your AI coding agent has access to your SSH keys, cloud credentials, and environment variables. A single prompt injection — hidden text on a webpage, a malicious comment in code — can trick it into exfiltrating your secrets.

These hooks stop that before it happens.

The Problem

This is not theoretical. If you have Bash(curl *) in your allowed permissions, you are one prompt injection away from credential theft.

The Solution: 7 Layers

Quick Start

The installer will:
- Copy hook scripts to ~/.claude/hooks/
- Show you the JSON to add to your ~/.claude/settings.json
- Place canary files in ~/.ssh/ and other sensitive directories
- Audit your current permissions for dangerous patterns

What Gets Blocked

Credential + Network = Blocked

Direct Reads = Blocked

Self-Modification = Blocked

Hook Details

Layer 1: security-guard.sh

The main defense. Intercepts every Bash command and checks 7 rules:

Layer 2: read-guard.sh

Blocks Claude's Read tool on:

Layer 3: bash-read-guard.sh

Catches shell commands reading sensitive files: cat, head, tail, less, cp, mv, tar, zip, input redirects (<), and editors.

Layer 4: Hook Self-Protection

Inline Edit hook — blocks modifications to ~/.claude/settings.json and ~/.claude/hooks/. If the AI is compromised, it cannot disable its own guardrails.

Layer 5–6: POST Whitelist & Encoding Detection

Built into security-guard.sh. POST/upload only allowed to:
- api.anthropic.com, github.com, registry.npmjs.org
- localhost / 127.0.0.1
- Tailscale subnet (100.64.0.0/10)

Add your own domains in security-guard.sh Rule 3.

Layer 7: Canary Files

The last line of defense. If the AI bypasses all hooks and reads a file in ~/.ssh/, it encounters:

Fighting…