# L3 Blacklist Hook — Example Setup

This example shows how to configure a Level 3 blacklist hook for Claude Code on a web application project.

## Installation

```bash
# Install the security-foundation kit
bash install.sh security

# Or manually copy the hook
cp skills/kits/security-foundation/skills/damage-control/hooks/pre-tool.l3-blacklist.js .claude/hooks/
```

## Configuration: Web App Project

```yaml
# .claude/hooks/l3-blacklist.yaml
blocked_commands:
  # Destructive operations
  - pattern: "rm -rf"
    severity: critical
  - pattern: "rm -r"
    severity: critical
  - pattern: "git clean -fdx"
    severity: high
  - pattern: "git reset --hard"
    severity: high
  - pattern: "drop table"
    severity: critical
  - pattern: "drop database"
    severity: critical
  - pattern: "truncate"
    severity: high
    
  # Network operations (warn only)
  - pattern: "curl -X POST"
    severity: warn
  - pattern: "nc "
    severity: warn
```

## Expected Behavior

| Command | Blocked? | Response |
|---------|----------|----------|
| `rm -rf node_modules` | YES | `BLOCKED: rm -rf is not allowed` |
| `git status` | Allowed | Normal output |
| `npm install express` | Allowed | Normal output |
| `DROP TABLE users` | YES | `BLOCKED: DROP TABLE is not allowed` |
| `git commit -m "fix"` | Allowed | Normal output |

## Testing It Works

```bash
# Should be blocked
echo "test" > /tmp/test-rm.txt && rm -rf /tmp/test-rm.txt

# Output: BLOCKED: rm -rf is not allowed
```