claude-guardrails

The skill defines multiple PreToolUse hooks that extract and analyze bash commands from the tool_input.command field using jq. While the hooks implement security checks, they process user-controlled command strings through shell evaluation (grep -qEi) which could potentially be exploited if the jq extraction or shell processing is bypassed. The hooks use bash -c with command substitution that processes the raw command content.

The skill's hook configuration includes patterns that detect and block force flags like '--dangerously-skip-permissions' and '--bypass-permissions', but the presence of these patterns in the detection logic indicates awareness of elevated execution attempts. While the skill blocks these patterns (which is good), the configuration itself demonstrates handling of privilege escalation scenarios.

The skill implements extensive system boundary protection by denying access to sensitive system files and directories including SSH keys, AWS credentials, shell profiles, and environment files. While this is protective behavior, the comprehensive list indicates the skill operates in contexts where system boundary violations are possible and must be actively prevented.

The skill contains explicit blocking rules for data exfiltration patterns, including detection of curl/wget pipes to external services like ngrok, burp, requestbin, pipedream, webhook.site, hookbin, and canarytokens. While this is protective behavior, the presence of these specific patterns indicates awareness of concrete exfiltration vectors.

The companion script contains a pattern that searches for 'base64 -d' commands, which could indicate awareness of base64 encoding/decoding operations. While this appears to be part of a security detection mechanism rather than obfuscated instructions, the presence of encoding-related patterns warrants review.

The skill contains hooks that establish persistent behavioral rules for bash commands without explicit termination conditions. These hooks will apply to all future bash tool usage across any task, not just the current skill execution. The PreToolUse hooks create permanent command filtering that persists beyond the skill's declared purpose.

The skill is named 'Claude Guardrails' suggesting it provides safety features, but it establishes hooks that intercept and potentially block ALL bash command execution across any task. This extends far beyond typical guardrail scope into general command execution control. The hooks apply broad pattern matching to all bash usage regardless of task context.