61 lines
1.4 KiB
Markdown
61 lines
1.4 KiB
Markdown
# L3 Blacklist Hook — Example Setup
|
|
|
|
This example shows how to configure a Level 3 blacklist hook for Claude Code on a web application project.
|
|
|
|
## Installation
|
|
|
|
```bash
|
|
# Install the security-foundation kit
|
|
bash install.sh security
|
|
|
|
# Or manually copy the hook
|
|
cp skills/kits/security-foundation/skills/damage-control/hooks/pre-tool.l3-blacklist.js .claude/hooks/
|
|
```
|
|
|
|
## Configuration: Web App Project
|
|
|
|
```yaml
|
|
# .claude/hooks/l3-blacklist.yaml
|
|
blocked_commands:
|
|
# Destructive operations
|
|
- pattern: "rm -rf"
|
|
severity: critical
|
|
- pattern: "rm -r"
|
|
severity: critical
|
|
- pattern: "git clean -fdx"
|
|
severity: high
|
|
- pattern: "git reset --hard"
|
|
severity: high
|
|
- pattern: "drop table"
|
|
severity: critical
|
|
- pattern: "drop database"
|
|
severity: critical
|
|
- pattern: "truncate"
|
|
severity: high
|
|
|
|
# Network operations (warn only)
|
|
- pattern: "curl -X POST"
|
|
severity: warn
|
|
- pattern: "nc "
|
|
severity: warn
|
|
```
|
|
|
|
## Expected Behavior
|
|
|
|
| Command | Blocked? | Response |
|
|
|---------|----------|----------|
|
|
| `rm -rf node_modules` | YES | `BLOCKED: rm -rf is not allowed` |
|
|
| `git status` | Allowed | Normal output |
|
|
| `npm install express` | Allowed | Normal output |
|
|
| `DROP TABLE users` | YES | `BLOCKED: DROP TABLE is not allowed` |
|
|
| `git commit -m "fix"` | Allowed | Normal output |
|
|
|
|
## Testing It Works
|
|
|
|
```bash
|
|
# Should be blocked
|
|
echo "test" > /tmp/test-rm.txt && rm -rf /tmp/test-rm.txt
|
|
|
|
# Output: BLOCKED: rm -rf is not allowed
|
|
```
|