agentic-ai-engineering/skills/kits/security-foundation/examples/L3-blacklist-hook.md

L3 Blacklist Hook — Example Setup

This example shows how to configure a Level 3 blacklist hook for Claude Code on a web application project.

Installation

# Install the security-foundation kit
bash install.sh security

# Or manually copy the hook
cp skills/kits/security-foundation/skills/damage-control/hooks/pre-tool.l3-blacklist.js .claude/hooks/

Configuration: Web App Project

# .claude/hooks/l3-blacklist.yaml
blocked_commands:
  # Destructive operations
  - pattern: "rm -rf"
    severity: critical
  - pattern: "rm -r"
    severity: critical
  - pattern: "git clean -fdx"
    severity: high
  - pattern: "git reset --hard"
    severity: high
  - pattern: "drop table"
    severity: critical
  - pattern: "drop database"
    severity: critical
  - pattern: "truncate"
    severity: high
    
  # Network operations (warn only)
  - pattern: "curl -X POST"
    severity: warn
  - pattern: "nc "
    severity: warn

Expected Behavior

Command	Blocked?	Response
rm -rf node_modules	YES	BLOCKED: rm -rf is not allowed
git status	Allowed	Normal output
npm install express	Allowed	Normal output
DROP TABLE users	YES	BLOCKED: DROP TABLE is not allowed
git commit -m "fix"	Allowed	Normal output

Testing It Works

# Should be blocked
echo "test" > /tmp/test-rm.txt && rm -rf /tmp/test-rm.txt

# Output: BLOCKED: rm -rf is not allowed