skills.rest
Arete-Consortium
Arete-ConsortiumOFFICIAL
Explore all skills by this author →
GitHub

security-hooks

Configures Claude Code PreToolUse hooks that block sensitive file writes and gate dangerous commands.

4|2|Updated Jan 27, 2026
Search Tags:#claude code#bash#guardrails#pretooluse#credential protection#git protection#security hooks
One-click install
npx skills add https://github.com/Arete-Consortium/ai-skills --skill security-hooks-arete-consortium
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-hooks
Source: https://github.com/Arete-Consortium/ai-skills/tree/main/personas/claude-code/security-hooks
Command: npx skills add https://github.com/Arete-Consortium/ai-skills --skill security-hooks-arete-consortium

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires jq.

What problem does it solve? Claude Code can execute file writes and shell commands that touch credentials, system paths, or destructive git operations, and without guardrails these actions run unchecked. This Skill deploys hook-layer protections that Claude cannot bypass, blocking or gating risky operations before they execute. ## Core Features & Use Cases - Seven Ready-to-Deploy Hook Scripts: Hard blocks for sensitive files (.env, keys, credentials), protected files (lock files, .git internals), and system paths; soft confirmation gates for dangerous bash commands, destructive git operations, network calls, and permission changes. - Decision Model with JSON Contract: Uses exit code 2 for hard denies and the permissionDecision JSON protocol (allow/deny/ask) for user confirmation gates. - Input Validation Patterns: Built-in defenses against path traversal, null bytes, and command injection in hook scripts. - Use Case: When starting a new project, deploy the minimal setup (sensitive-file block plus destructive-git gate) to .claude/settings.json so Claude cannot overwrite .env files or force-push without your confirmation. ## Quick Start Ask Claude to set up security hooks for this project by deploying the sensitive-file blocker and destructive-git gate into .claude/hooks and registering them in .claude/settings.json.

Frequently Asked Questions about security-hooks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I block Claude Code from editing .env files?▼

Add a PreToolUse hook matching Write|Edit that checks tool_input.file_path against sensitive patterns like .env, .key, .pem, and credentials. When matched, print a block message to stderr and exit with code 2 to deny the operation.

How to require confirmation before git force push in Claude Code?▼

Create a PreToolUse hook matching Bash that greps the command for patterns like git push --force, git reset --hard, or git branch -D. On match, output JSON with permissionDecision set to ask so the user must confirm before execution.

What is the difference between exit code 2 and permissionDecision ask in hooks?▼

Exit code 2 is a hard block that denies the tool call outright, with stderr shown to Claude as the reason. permissionDecision ask is a soft gate that exits 0 and outputs JSON on stdout, prompting the user to confirm before the operation proceeds.

Does the security hooks setup work on Windows and macOS?▼

The hook scripts target Linux and macOS portability by avoiding GNU-only flags, and the system path guard also matches Windows paths like C:\Windows. All scripts require jq to be installed for parsing the stdin JSON payload.

Why did my PreToolUse hook not block a dangerous command?▼

Hooks fail open by design: exit code 1 means the hook crashed and the tool proceeds. Common causes are missing jq, non-executable script permissions, a matcher that does not cover the tool name, or a regex pattern that misses the command variant.

When should I use hooks-designer instead of security-hooks?▼

Use hooks-designer for general-purpose hook workflows such as PostToolUse logging, TDD guards, and auto-formatting. Security-hooks is specifically for protective PreToolUse guards against sensitive file access, destructive commands, and system-level changes.

Related Skills

Explore More Software Engineering Skills→
m2ai-portfoliom2ai-portfolio
4

plan-stop-hook

Block Edit, Write, and Bash until a planning gate file is approved.

Official
Intermediate
code-highway-patrolcode-highway-patrol

status

Monitor and report codebase guardrail enforcement status with law severity levels.

Official
Intermediate
kivo360kivo360
1

moai-cc-hooks

Configure Claude Code safety hooks across PreToolUse, PostToolUse, SessionStart, Notification, and Stop events.

Community
Advanced
jiten-singh-shahijiten-singh-shahi
13

security-scan

Audit Claude Code configuration files for security vulnerabilities and emit JSON findings.

Community
Intermediate