rules-claude-code

File writes via `bun -e` route around governance hooks — they hide the target path from the rule engine. Use the Write or Edit tool, or commit a tracked .ts script and run it via `bun run`.

File writes via `node -e`/`node --eval` route around governance hooks — they hide the target path from the rule engine. Use the Write or Edit tool, or commit a tracked .js script and run it via `node script.js`.

File writes via `perl -e` or in-place edits via `perl -i` route around governance hooks. Use the Write or Edit tool.

File writes via `python -c` route around governance hooks — they hide the target path from the rule engine. Use the Write or Edit tool, or commit a tracked .py script and run it via `python3 script.py`.

File writes via `ruby -e` or in-place edits via `ruby -i` route around governance hooks. Use the Write or Edit tool.

Use of MD5 for security-sensitive hashing detected. MD5 is cryptographically broken and unsuitable for password storage, digital signatures, or data integrity checks where collision resistance is required. Use stronger algorithms like 'hashlib.sha256', 'hashlib.sha3_256', 'bcrypt', 'scrypt', or 'argon2' for security purposes.

Violation of 'claude-code' (Google-inspired) Python Style Guide: Wildcard import detected. Wildcard imports ('from module import *') make it difficult to determine where names come from, can lead to name collisions, and obscure dependencies. Prefer explicit imports (e.g., 'from module import func1, func2') or import the module directly (e.g., 'import module') and use 'module.func1' for clarity and maintainability.

Hardcoded sensitive credential detected (e.g., API key, secret key, password). Storing sensitive information directly in code is a severe security risk. Use environment variables (e.g., 'os.environ.get("API_KEY")') or a secure secrets management system to handle credentials.

Insecure command execution detected. 'os.system()' is deprecated and highly vulnerable to command injection if used with untrusted input. Prefer 'subprocess.run()' with 'shell=False' and a list of arguments for safer external command execution, ensuring all inputs are properly sanitized.

Potential insecure deserialization detected. Using 'pickle.loads()' with untrusted input can lead to arbitrary code execution. Consider safer data formats like JSON or YAML, or implement robust input validation and integrity checks if pickle is unavoidable for trusted data.

Potential Path Traversal vulnerability in Node.js. Concatenating unsanitized user input (from 'req.query', 'req.params', or 'req.body') directly into 'path.join()' can allow attackers to access arbitrary files outside the intended directory. Always sanitize and validate user input, or use 'path.resolve()' with a base directory and ensure the resolved path is strictly within the intended directory.

Potential SQL Injection via f-string detected. Directly embedding unsanitized user input (e.g., from 'request' object, 'user_input', or 'data') into SQL queries using f-strings is highly insecure. Use parameterized queries (e.g., 'cursor.execute("SELECT * FROM users WHERE id=?", (user_id,))') to prevent injection attacks.

Claude Code config directory modification. CVE-2025-59536 demonstrated RCE via malicious .claude/ configs in cloned repositories. Modifying the .claude/ directory structure requires human review.

Claude Code project config read. Malicious project configs are a documented RCE vector (CVE-2025-59536). Verify this file originates from a trusted source before the agent processes its contents.

Writing Claude Code settings. Malicious settings can disable safety features, register unsafe hooks, or modify permission boundaries — as demonstrated in CVE-2025-59536. Verify changes before writing.

Claude Code session or config file accessed. Audit trail for CVE-2026-21852 detection. Session files may contain conversation history with sensitive project context.

CLAUDE.md written. This file is injected into every Claude Code conversation. Malicious instructions or hidden Unicode in CLAUDE.md constitute a persistent prompt injection attack against all future sessions using this project.

Simple reconnaissance command logged. Research (The Register, April 2026) shows Claude Code's safety rule cap can be overwhelmed by rapid sequential commands, causing safety rules to stop firing. Monitoring for volume anomalies.

Command substitution targeting Claude Code context detected. Attackers use nested command substitution to bypass regex-based command blacklists — a documented class of Claude Code safety bypass. Use explicit, fully-expanded commands without subshells.

CVE-2025-59536: Malicious .claude/hooks/ scripts achieve RCE when Claude Code processes project configs. Executing hook scripts from cloned project directories is blocked. Hooks must be managed manually in your personal ~/.claude/ config, never run by the agent.

Source code exfiltration via npm debug source maps. In March 2026, Anthropic accidentally published a debug source map on npm that reconstructed 500,000+ lines of internal TypeScript. NODE_OPTIONS with source-map flags in production contexts is blocked.

Anthropic credential storage access blocked. CVE-2026-21852 demonstrated API credential theft through project config manipulation. Reading Anthropic config directories outside the official CLI is blocked. Use environment variables: ANTHROPIC_API_KEY.

CVE-2026-21852: API credential theft via project configurations. Reading Claude Code credential files is blocked. Attackers embed malicious configs in project .claude/ directories that, when processed, read and exfiltrate API credentials. Access credentials only through the official CLI and environment variables.

Writing to Claude Code credential storage blocked. CVE-2026-21852 (Claude Code versions prior to 2.0.65) allowed credential theft via malicious project configurations. Credentials are managed by the official CLI only.

CVE-2025-59536: Writing to .claude/hooks/ achieves RCE when Claude Code processes project configs. Researchers found it 'relatively easy for a bad actor to introduce a malicious Hook command in Claude Code's configuration file' that auto-executes when a developer opens the project. Hook files must be created manually by the developer, never by an AI agent.