Files
playableintelligence__game-…/settings.json
T
rshtirmer 66e591a2a4 feat(security): intercept API keys pasted in chat via UserPromptSubmit hook
API keys pasted in chat previously ended up in Claude's context window.
This adds a UserPromptSubmit hook that detects key patterns, saves them
to .env, and blocks the message so keys never reach the model.

- Add scripts/intercept-api-key.mjs (zero deps, explicit + bare key detection)
- Add hooks.UserPromptSubmit config to settings.json
- Add .env to .gitignore
- Update 6 skill prompts to use KEY=value paste format with .env check-first

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-10 17:38:44 -04:00

20 lines
330 B
JSON

{
"agent": "game-creator",
"env": {
"CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS": "1"
},
"hooks": {
"UserPromptSubmit": [
{
"hooks": [
{
"type": "command",
"command": "node scripts/intercept-api-key.mjs",
"timeout": 5
}
]
}
]
}
}