Claude Hooks (Prompt Injection Defender) skill
Claude Hooks
A Claude Code hook that scans file, web page and command output for hidden instructions and warns the agent
- 269 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- Registers PostToolUse hooks in Claude Code settings, so a script runs after every monitored tool
- Reads the full output of files, web pages and commands to match patterns, but writes nothing and sends nothing out
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/claude-hooksDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Registers PostToolUse hooks in Claude Code settings, so a script runs after every monitored tool
- Reads the full output of files, web pages and commands to match patterns, but writes nothing and sends nothing out
This is third-party code. Review the repository files before installing.
What it does
The repository ships a Prompt Injection Defender skill: PostToolUse hooks for Claude Code that guard against indirect prompt injection. That is an attack where instructions are hidden in content the agent reads on its own: a file, a web page, command output. The hook inspects results from Read, WebFetch, Bash, Grep, Task and any MCP tool. Detection uses regular expressions from patterns.yaml, with no API calls and no token cost. The patterns fall into five categories: instruction override ("ignore previous instructions"), role-play jailbreaks such as DAN, encoding and obfuscation (base64, hex, leetspeak, homoglyphs, invisible Unicode), fake authority claims, and instructions smuggled into HTML or code comments. Each pattern carries a severity of high, medium or low. On a match, Claude gets a warning in its context with the source and the list of findings. The hook blocks nothing: the agent still sees the content but knows not to follow instructions found in it. You can extend patterns.yaml, and the repository includes test files and test prompts to check the setup. Implementations exist in Python for uv and in TypeScript for Bun.
Who it is for. For developers who let Claude Code read third-party repositories, web pages and MCP server output and want a signal about instructions hidden in them.
Good fit when
- Claude Code analyses a third-party repository whose README or comments may hide commands
- The agent browses pages through WebFetch or reads responses from MCP servers you do not fully trust
- You want a cheap first-pass check with no LLM calls and no paid APIs
- You are writing your own patterns and want to test them against ready-made test files
Not a fit when
- You need blocking of dangerous actions: the hook only warns and does not stop the call
- You work in Cursor, Codex or another agent: the hooks target Claude Code
- You expect protection against sophisticated attacks: patterns catch known tricks and do not replace isolation and permissions
- You need a check before commands run rather than after their output arrives
Example request
Install the prompt injection defender in this project and run it against the test files from the repositoryLimitations
The detector is pattern based and catches only known phrasings, so legitimate text, for example articles about security, can trigger false positives. It warns and blocks nothing: the agent still sees the full content. Hooks run after the tool has executed, so the call itself has already happened by then. The Python version requires the uv package manager. Installation targets Claude Code, and other agents do not read hooks with this configuration.
How to disable. Remove the PostToolUse blocks that reference prompt-injection-defender from the project's .claude/settings.local.json and delete the .claude/hooks/prompt-injection-defender folder.
FAQ
Does Prompt Injection Defender block suspicious content?
No. The hook adds a warning to Claude's context with the source and severity of the findings, and processing continues. The agent decides whether to follow the instructions it found, and the warning advises treating them with suspicion.
Which Claude Code tools does the hook check?
Read, WebFetch, Bash, Grep, Task and any MCP tool. Their output is scanned after execution.
How do I add my own detection pattern?
Add an entry to patterns.yaml with a Python regular expression, a reason and a severity of high, medium or low. Then test it with uv run test-defender.py -i or on a file with the --file flag.
Does it need an API key?
No. The check runs locally on regular expressions only, so no model tokens are spent.
What should I do after a hook warning?
Open the source named in the warning and check whether it contains a hidden instruction. If the match is false, relax or remove the pattern in patterns.yaml.
Discussion
No questions or reviews yet.
Related
SkillsA marketplace of 22 hook plugins for Claude Code: safety, cost control, observability and automation
AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
An authorized bug-bounty suite: 50 subagents, 26 commands and 2 bug-bounty-platform MCP servers for Claude Code, Codex and five more agents
A Claude Code hook that rates Bash command risk with rules and Haiku, asking for approval only on risky commands
Anthropic's reference set for defending code: threat-model, vuln-scan, triage and patch skills in Claude Code plus an autonomous vulnerability pipeline
A plugin and approval server for Claude Code and Codex: a risky tool call waits for your decision before it runs
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Repository stars | Main difference |
|---|---|---|---|
| Claude Hooks (Prompt Injection Defender) (this entry) | no | 269 | |
| CC Safety Net | no | 1,849 | blocks destructive Git and file system commands before they run, while Defender warns about instructions in content that was read |
| Sage | yes | 322 | checks the agent's commands, URLs and file writes and blocks dangerous ones, while Defender only scans tool output |
README in short
The Lasso Security repository explains indirect prompt injection and ships a ready defence for Claude Code. It describes the attack categories, the warning format and the list of monitored tools. Installation works through the install.sh script or by asking the agent when the repository is added as a skill. A separate link points to Lasso Security's research on this vulnerability.
README badge
Original SKILL.md
# Prompt Injection Defender Skill
## Overview
Defense against **indirect prompt injection** attacks for Claude Code. This skill provides PostToolUse hooks that scan tool outputs (files, web pages, command results) for injection attempts and warn Claude about suspicious content.
## Features
- **Real-time scanning** of tool outputs (Read, WebFetch, Bash, Grep, Task, MCP tools)
- **4 detection categories**: Instruction Override, Role-Playing/DAN, Encoding/Obfuscation, Context Manipulation
- **50+ patterns** covering known injection techniques
- **Warn + Continue** approach (doesn't block, just warns Claude)
- **Dual implementation**: Python/UV and TypeScript/Bun
## Skill Structure
```
prompt-injection-defender/
├── SKILL.md # This file
├── patterns.yaml # Single source of truth for detection patterns
├── cookbook/
│ ├── install_workflow.md # Interactive installation guide
│ ├── modify_patterns_workflow.md # Pattern modification guide
│ └── test_defender.md # Testing workflow
├── hooks/
│ ├── defender-python/ # Python implementation
│ │ ├── post-tool-defender.py
│ │ ├── python-settings.json
│ │ └── test-defender.py
│ └── defender-typescript/ # TypeScript implementation
│ ├── post-tool-defender.ts
│ ├── typescript-settings.json
│ └── test-defender.ts
└── test-prompts/ # Test scenarios
├── injection_v1.md # Instruction override tests
├── injection_v2.md # Role-playing tests
├── injection_v3.md # Encoding tests
└── injection_v4.md # Context manipulation tests
```
## Cookbook Decision Tree
### Triggers → Workflows
| User Request Pattern | Workflow to Use |
| ----------------------------------- | --------------------------- |
| "install prompt injection defender" | install_workflow.md |
| "install the defender" | install_workflow.md |
| "protect against prompt injection" | install_workflow.md |
| "add new pattern" | modify_patterns_workflow.md |