ship-safe-hooks
Install ship-safe as real-time Claude Code hooks — blocks secrets and dangerous commands before they land on disk. Use when the user wants automatic security scanning on every file write or bash command.
git clone --depth 1 https://github.com/asamassekou10/ship-safe /tmp/ship-safe-hooks && cp -r /tmp/ship-safe-hooks/claude-code-plugin/skills/ship-safe-hooks ~/.claude/skills/ship-safe-hooksSKILL.md
# Ship Safe — Claude Code Hooks You are installing ship-safe as real-time security hooks into Claude Code. Once installed, ship-safe will: - **Block** `Write` / `Edit` / `MultiEdit` calls that contain critical secrets (API keys, tokens, private keys) **before** they are written to disk - **Block** `Bash` calls matching dangerous patterns (curl piped to shell, credential exfiltration) - **Scan** every file after it is written and inject advisory findings directly into this conversation - **Show** a local `Protected by Ship Safe` status line in Claude Code when both hooks are ready ## Step 1: Determine the action If `$ARGUMENTS` is `remove`: run the remove command below. If `$ARGUMENTS` is `status`: run the status command below. Otherwise (default or `install`): run the install command. ## Step 2: Run the command **Install (default):** ```bash npx ship-safe@latest hooks install ``` **Remove:** ```bash npx ship-safe@latest hooks remove ``` **Status check:** ```bash npx ship-safe@latest hooks status ``` ## Step 3: Report the result **On install success:** - Confirm that two hooks are now registered in `~/.claude/settings.json` - Confirm that the Ship Safe status line is registered as well, unless another status line already exists - Explain what each hook does: - **PreToolUse** (on Write / Edit / MultiEdit / Bash): blocks critical secrets and dangerous commands in real time - **PostToolUse** (on Write / Edit / MultiEdit): scans the written file and reports findings in context - Tell the user that **no restart is needed** — hooks take effect immediately - The status line is a local indicator backed by the installed hooks; it is not a decorative claim **On remove success:** - Confirm the hooks were removed from `~/.claude/settings.json` **On status:** - Report which hooks are installed (✔) and which are missing (✗) - If any are missing, offer to run `install` **On error:** - If the command fails, check whether Node.js 18+ is available: `node --version` - If hook scripts are missing, suggest reinstalling: `npm install -g ship-safe` ## Notes - Hooks are stored in `~/.claude/settings.json` (global) so they apply to all Claude Code projects - The hooks are non-invasive: they only read file content and run patterns locally — no data is sent externally - PostToolUse never blocks, it only informs - To see what was installed: `cat ~/.claude/settings.json`
Manage your security baseline — accept current findings as known debt, then only report new regressions on future scans. Use when the user wants to adopt security scanning incrementally or suppress existing findings.
Run Ship Safe in CI mode — compact output, exit codes, SARIF generation. Use when the user wants to set up CI/CD security gates or test their pipeline configuration.
Run a deep security audit with LLM-powered taint analysis — regex scan nominates findings, then an LLM verifies taint reachability and exploitability. Use when the user wants thorough, high-confidence results with fewer false positives.
Auto-fix security issues — remediate hardcoded secrets and common vulnerabilities (TLS bypass, debug mode, XSS, shell injection, Docker :latest). Use when the user wants to automatically fix security findings.
Run a multi-agent red team scan — 29 specialized security agents scan for 80+ attack classes including injection, auth bypass, SSRF, supply chain, Supabase RLS, MCP security, agentic AI, RAG poisoning, PII compliance, and more. Use when the user wants a deep security analysis beyond just secrets.
Quick scan for leaked secrets — API keys, passwords, tokens, database URLs. Use when the user wants to check for hardcoded secrets or exposed credentials.
Get your project's security health score (0-100, A-F grade). Use when the user wants a quick security check or asks "is my code safe to ship?
Run a full security audit on this project — 16 agents scan for secrets, injections, auth bypass, SSRF, supply chain, Supabase RLS, MCP security, agentic AI, RAG poisoning, PII compliance, and more. Use when the user wants a security audit, vulnerability scan, or asks if their code is safe to ship.