1 file · 23 lines · 789 B
View on GitHub
yurukusa Add shell-wrapper-guard hook to security category Detects destructive commands hidden in shell wrappers (sh -c, bash -c, python3 -c, node -e, etc). Complements dangerous-command-blocker by catching 8 bypass vectors that evade direct command checks. From cc-safe-setup (667 hooks, 9,200+ tests, 800hrs autonomous operation). https://github.com/yurukusa/cc-safe-setup Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> 5299c0cApr 13, 2026
- shell-wrapper-guard.json 23 lines · 789 B
shell-wrapper-guard.json
JSON
{
"description": "Detects destructive commands hidden inside shell wrappers (sh -c, bash -c, pytho..."
"supportingFiles": [
{3 keys}
]
"hooks": {
"PreToolUse": [1 item]
}
}
Scanned by NVIDIA SkillSpector
Automated static analysis (no LLM) · v2.12.0 · 2026-10-17
21 observations
scanner score 45/100
SkillSpector looks for patterns such as shell commands, credential access, network calls or unpinned dependencies. An observation is something worth reading in the files before you install, not a confirmed vulnerability. Components that run code locally, like hooks, MCP servers and security tooling, naturally show more of them.
- Tool Parameter Abuse ×2Tool Misuse · SKILL.md:3
- Tool Parameter Abuse ×2Tool Misuse · shell-wrapper-guard.json:2
- Tool Parameter Abuse ×16Tool Misuse · shell-wrapper-guard.sh:5
- Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: shell.MCP Least Privilege · SKILL.md:1
Learn more about NVIDIA SkillSpector or how components are reviewed.