Zebonastic

Claude Tools / Hooks / Secret Guard

Illustrative event-triggered script

Secret Guard

Checks proposed shell commands and file writes for exposed credentials before execution.

PreToolUse
PreviewSource shapeAudit notes
$starter/hooks/secret-guard

Template signals

Status

Draft

Audit

Not run

Collection

Hooks

Anatomy

What it contains

  • An event name and optional matcher
  • A command, prompt, or HTTP action
  • Timeout, dependency, and failure behavior

Lifecycle

How it works

  1. Claude Code emits a lifecycle event
  2. The matcher decides whether the hook applies
  3. The configured action runs automatically
  4. Its result allows, blocks, or annotates the event

Audit lens

What Zebonastic would check

  • Automatic execution is visible and justified
  • Shell input is quoted and validated
  • Timeouts, dependencies, and failure modes are declared

Content preview

Configuration

Editable starter content12 lines
{
  "hooks": {
    "PreToolUse": [{
      "matcher": "Bash|Write",
      "hooks": [{
        "type": "command",
        "command": "python3 scripts/check_secrets.py",
        "timeout": 10
      }]
    }]
  }
}

Related

More Hooks

← Back to Hooks