Skip to content

feat(instructions-audit): audit loaded instruction files for hidden directives #40

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
karanb192 merged 2 commits into from
Aug 18, 2026
Merged

feat(instructions-audit): audit loaded instruction files for hidden directives #40

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
58e2ad3
feat(instructions-audit): audit loaded instruction files for hidden d…
karanb192 Aug 17, 2026
645397b
feat(instructions-audit): real enforcement and wider invisible-char net
karanb192 Aug 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 9 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
[![GitHub stars](https://img.shields.io/github/stars/karanb192/claude-code-hooks?style=social)](https://github.com/karanb192/claude-code-hooks)
[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![CI](https://github.com/karanb192/claude-code-hooks/actions/workflows/test.yml/badge.svg)](https://github.com/karanb192/claude-code-hooks/actions/workflows/test.yml)
[![Tests](https://img.shields.io/badge/tests-1382%20passing-brightgreen)](https://github.com/karanb192/claude-code-hooks/actions/workflows/test.yml)
[![Tests](https://img.shields.io/badge/tests-1499%20passing-brightgreen)](https://github.com/karanb192/claude-code-hooks/actions/workflows/test.yml)

**🌐 [Live site & catalog](https://karanb192.github.io/claude-code-hooks/)**

Expand Down Expand Up @@ -55,6 +55,14 @@ Runs at session boundaries — inject context at **SessionStart** and capture ou

> 🔌 **`nerf-receipts`** (personal model-quality flight recorder) and **`standup-autopilot`** (writes your daily standup from what your agents actually did; re-injects open blockers) now ship as installable **plugins** — see [Install as a plugin](#-install-as-a-plugin).

### Instructions-Loaded

Fires when a CLAUDE.md or `.claude/rules/*.md` file is loaded into context. The event has no decision control, its exit code is ignored, and current Claude Code builds ignore even the universal `continue: false` on it (verified live), so detection and enforcement are split: the InstructionsLoaded registration records a per-session lock on a finding (and still emits `continue: false` for builds that honor it), and the same script registered on UserPromptSubmit and PreToolUse blocks every prompt and tool call for that session until a human fixes the file or deletes the named lock file.

| Hook | Matcher | Description |
|------|---------|-------------|
| [instructions-audit](hook-scripts/instructions-loaded/instructions-audit.js) | `session_start\|nested_traversal\|path_glob_match\|include\|compact` (or omit for all) | Locks the session when a loaded instruction file carries hidden directives: invisible-Unicode smuggling (zero-width, tag characters, variation-selector runs; the TrapDoor supply-chain signature), bidi overrides, directives to read or exfiltrate secrets, curl\|sh, decode-and-execute, and hook/settings tampering. Names the rule and line number so you can inspect the file; register the same script on UserPromptSubmit and PreToolUse for the enforcement arm; `HOOK_AUDIT_WARN_ONLY=true` warns without locking. |

### User-Prompt-Submit

Runs when the user submits a prompt, before Claude processes it. Can inject context or block the prompt.
Expand Down
Loading
Loading