A Claude Code PreToolUse hook that checks file paths and content before Edit, Write, or MultiEdit operations for 12 listed security anti-patterns.
Tasks
Install the security-guidance Claude Code plugin and use it during sessions that edit security-sensitive code.
Review a first-session warning for a matching file-and-rule combination before proceeding with an Edit, Write, or MultiEdit operation.
Use the debug log to investigate hook misfires, JSON decode errors, or state-file save failures.
Inputs
File path being edited
Content being written
Tool input as JSON on stdin
ENABLE_SECURITY_REMINDER environment variable
Outputs
Warnings printed to stderr for a first matching file-and-rule combination in a session
Exit code 2 when a pattern matches for the first time for that file-and-rule combination in a session
Exit code 0 when no pattern matches or when the matching warning was already shown in the session
Session-scoped warning-state JSON files under ~/.claude/
Debug log at ~/.claude/security-warnings-log.txt
Limitations and checks
Detection uses substring matching rather than AST-based analysis.
String literals containing patterns such as eval( can produce false positives.
A matching file-and-rule combination is warned about and blocked only the first time in a session; subsequent matching calls for that combination are allowed.
The hook checks known patterns listed by the skill and does not replace a proper SAST tool for stricter detection.
Confirm the hook runs before Edit, Write, and MultiEdit operations.
Confirm GitHub Actions workflow file paths are checked for risky ${{ }} patterns.
Confirm written content is checked for listed command injection, code injection, XSS, deserialization, and SQL injection patterns.
Confirm a first matching file-and-rule combination prints a warning and exits with code 2.