claude-code-complete-agent/hooks

Hooks

Claude Code hooks are shell scripts or HTTP endpoints that run before or after tool execution. They are the primary runtime security mechanism, equivalent to OpenClaw's exec approvals and Docker sandboxing.

Files in this directory

File	Hook event	Purpose
pre-tool-use.sh	PreToolUse	Blocks dangerous shell commands (educational demo)
post-tool-use.sh	PostToolUse	Logs all tool executions (educational demo)
audit.log	(generated)	Append-only audit trail

These scripts demonstrate the hook mechanism with basic pattern matching. For production use, see the next section.

Production hooks: llm-security plugin

The llm-security plugin provides 8 production-grade hooks that cover the OpenClaw CVEs documented in security/cve-mitigation-map.md:

Hook	Event	CVE coverage
pre-prompt-inject-scan.mjs	UserPromptSubmit	CVE-2026-30741 (prompt injection to RCE)
pre-edit-secrets.mjs	PreToolUse (Edit/Write)	Credential exfiltration prevention
pre-bash-destructive.mjs	PreToolUse (Bash)	CVE-2026-32048 (sandbox escape), CVE-2026-32032 (shell injection)
pre-install-supply-chain.mjs	PreToolUse (Bash)	Supply chain attacks (ClawHub malware equivalent)
pre-write-pathguard.mjs	PreToolUse (Write)	CVE-2026-22171 (path traversal/file write)
post-mcp-verify.mjs	PostToolUse (all)	CVE-2026-29607 (approval bypass via output injection)
post-session-guard.mjs	PostToolUse (all)	Runtime trifecta detection (untrusted input + data access + exfiltration)
update-check.mjs	UserPromptSubmit	Version currency

Key differences from the demo hooks in this directory:

Aspect	Demo hooks (this repo)	llm-security hooks
Language	Bash (grep-based)	Node.js (cross-platform)
Detection	Simple pattern matching	Regex, Levenshtein distance, taint tracing
Coverage	Bash commands only	All tool types + MCP output + prompts
Supply chain	Not covered	7 package managers, OSV.dev, typosquat detection
Prompt injection	Not covered	3-layer defense (input, output, session pattern)

Installing llm-security

# In your Claude Code settings (~/.claude/settings.json):
{
  "enabledPlugins": {
    "llm-security@plugin-marketplace": true
  }
}

Or clone standalone:

git clone https://git.fromaitochitta.com/open/claude-code-llm-security.git \
  ~/.claude/plugins/llm-security

How hooks work

Hooks are configured in .claude/settings.json:

{
  "hooks": {
    "PreToolUse": [{
      "matcher": "Bash",
      "hooks": [{
        "type": "command",
        "command": "bash hooks/pre-tool-use.sh"
      }]
    }]
  }
}

PreToolUse

Runs before a tool executes. The script receives JSON on stdin with tool_name and tool_input. Return decisions:

• Exit 0: allow (no output needed)
• Exit 2 + JSON {"decision": "block", "reason": "..."}: block the tool call

PostToolUse

Runs after a tool executes. Same stdin format plus tool_output. Cannot block (already executed). Use for logging, notifications, or triggering follow-up actions.

Other hook events

Event	When it fires
SessionStart	When Claude Code launches
UserPromptSubmit	Before processing user input
PreToolUse	Before a tool executes
PostToolUse	After a tool executes
Stop	When Claude Code finishes a response
SubagentStop	When a subagent completes
Notification	When Claude Code shows a notification

Comparison to OpenClaw

Feature	OpenClaw	Claude Code
Exec blocking	/approve command + DM pairing	PreToolUse hooks
Audit logging	command-logger hook	PostToolUse hooks
Tool deny lists	Per-session/agent config	settings.json deny + hooks
Container isolation	Docker sandbox (off/non-main/all)	macOS sandbox-exec (optional)
Policy engine	NemoClaw YAML policies	Hook scripts (any logic)
Prompt injection	Tool policy validation (bypassed: CVE-2026-29607, 28460)	Multi-layer hooks (input + output + session)
Supply chain	Manual review (824 malicious skills found)	Automated scanning (7 package managers)

Claude Code hooks are more flexible (arbitrary shell logic) but require more setup. OpenClaw's approach is more structured but has documented enforcement gaps.