Next step

More hooks in security, in alphabetical order.

• Hook · security Force Push Blocker Block git force push commands using the if condition for efficient filtering. Prevents accidental force pushes that can overwrite remote history. Covers --force, --force-with-lease, and the -f shorthand.
  npx … --hook security/force-push-blocker

  Add to stack
• Hook · security Secret Scanner Automatically detects hardcoded secrets before git commits. Scans for API keys from 30+ providers (Anthropic: sk-ant-..., OpenAI: sk-..., AWS: AKIA..., Stripe: sk_live_..., Google: AIza..., GitHub: ghp_..., Vercel, Supabase, Hugging Face: hf_..., Replicate: r8_..., Groq: gsk_..., Databricks: dapi..., GitLab, DigitalOcean, npm, PyPI, and more), tokens, passwords, private keys, and database credentials. Blocks commits containing secrets and suggests using environment variables instead.
  npx … --hook security/secret-scanner

  Add to stack
• Hook · security Security Scanner Scan code for security vulnerabilities and secrets after modifications. Uses multiple security tools to detect potential issues.
  npx … --hook security/security-scanner

  Add to stack
• Hook · security Shell Wrapper Guard Detects destructive commands hidden inside shell wrappers (sh -c, bash -c, python3 -c, node -e, perl -e, ruby -e). Complements dangerous-command-blocker by catching bypass vectors like 'sh -c "rm -rf /"' that evade direct command checks. Covers 8 bypass patterns: interpreter one-liners, nested wrappers, pipe-to-shell, here-strings, and env-based wrappers.
  npx … --hook security/shell-wrapper-guard

  Add to stack
• Hook · security Subagent Read Only Guard Enforces read-only subagents. A PreToolUse hook denies Edit, Write, MultiEdit, NotebookEdit and PowerShell, and any Bash or Monitor command that is not read-only, when the call comes from a subagent (detected by the agent_id field Claude Code adds only inside subagents; tested on Claude Code 2.1.296). Shell commands pass only when every command is a bare program from a short read-only allowlist (ls, cat, grep, rg, find, jq, sort, sed -n 'N,Mp', cd, git log/diff/status/show/blame/branch/tag and similar) without the options that make it write or run other programs, including abbreviated long options. Redirection to files, command substitution, shell expansion ($VAR, {a,b}), subshells, env-var prefixes, git -c and anything the guard cannot classify are denied, including its own errors. The main conversation is never affected. Not covered: MCP tools, and git diff/blame running diff or textconv drivers already configured in the repo. Reading secrets (.env, printenv) is still allowed, so pair it with env-file-protection. Pairs with the hooks/subagents-explore-only setting, which tells subagents up front that they are exploration-only.
  npx … --hook security/subagent-read-only-guard

  Add to stack
• Hook · security AI Bash Guard AI-powered bash command security guard. Before any Bash command runs, a lightweight Claude subagent evaluates it for destructive or irreversible patterns — recursive deletes, force pushes to protected branches, database drops, and credential exposure — and blocks execution with a clear explanation if flagged. Uses PreToolUse with type:agent, which is the only hook pattern that can block tool execution via AI reasoning.
  npx … --hook security/ai-bash-guard

  Add to stack