skills/trailofbits__skills
1
0
Fork 0
mirror of https://github.com/trailofbits/skills.git synced 2026-09-14 14:28:48 +08:00
Code Issues Packages Projects Releases Wiki Activity
Files
f09e5c729a297834680d0fbff675743ca23bf4a6
trailofbits__skills/plugins/modern-python/hooks/hooks.json
T

17 lines
352 B
JSON
Raw Normal View History

Add hook to modern-python to intercept python3 and pip calls (#40) * Add hook to modern-python to intercept python3 and pip calls Uses tree-sitter-bash parse the AST for more robust hooking * Fix ruff line-length lint in intercept-legacy-python hook Run ruff format to properly break long lines into multi-line tuples. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Rewrite legacy Python hook in shell for performance Replace tree-sitter-based Python implementation with a shell script using jq and regex patterns. This eliminates the overhead of spawning Python and loading tree-sitter on every Bash command. - Use jq for JSON parsing (fast, commonly available) - Regex-based pattern matching for python/pip commands - Allow uv run commands to pass through - Context-aware suggestions based on subcommand - Passes shellcheck validation Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Allow diagnostic commands and simplify error message - Skip `which`, `type`, `whereis`, `command -v` for python/pip - Simplify denial message (Claude already knows uv commands) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Allow search tools through legacy Python hook Add allowlist for grep, rg, ag, ack, find to prevent false positives when searching for "python" or "pip" as text patterns. Also normalize character class ordering for consistency with other patterns. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Fix shfmt formatting (2-space indent) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Add hook development guidance to CLAUDE.md Document design lessons from PR #40's Python-to-shell rewrite: - Performance: prefer shell+jq over Python with dependencies - Simplicity: accept false positives when performance gain is worth it - False positive awareness: diagnostic commands, search tools, filenames - Explicit tradeoff documentation in PR descriptions Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Refine CLAUDE.md formatting for consistent density Remove section breaks (horizontal rules) between major sections and condense the Hooks section from verbose multi-paragraph format into a unified list while preserving all guidance. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: Dan Guido <dan@trailofbits.com>
2026-01-26 19:03:08 -05:00
{
use PATH shim override technique instead of hooking every pre tool usage (#89) * use PATH shim override technique instead of hooking every pre tool usage * remove unecessary check * fix: resolve code review findings for PR #89 P1 fixes: - setup-shims.sh: Add CLAUDE_ENV_FILE guard to prevent opaque 'unbound variable' crash when env var is unset (matches gh-cli plugin pattern) P2 fixes: - setup-shims.sh: Guard shims_dir resolution failure to prevent empty PATH prefix on partial installs - shims/uv: Fix shfmt formatting (here-string spacing) - shims/uv: Resolve PATH entries before comparison to prevent exec loop with symlinked/unnormalized paths - shims/uv: Use ${PATH:-} to handle unset PATH defensively - setup-shims.bats: Add test for unset CLAUDE_ENV_FILE - uv-shim.bats: Add test for 'real uv not found' error path P3 dismissed: - CI linting gap for extensionless shim scripts: accepted as-is since shims must masquerade as real binaries (no .sh extension); manual review covers these files - Unset PATH in uv shim: addressed by ${PATH:-} fix above All 27 bats tests pass. shellcheck and shfmt clean. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Dan Guido <dan@trailofbits.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-12 22:16:40 -05:00
"description": "Intercept legacy Python/pip commands via PATH shims and suggest uv alternatives",
Add hook to modern-python to intercept python3 and pip calls (#40) * Add hook to modern-python to intercept python3 and pip calls Uses tree-sitter-bash parse the AST for more robust hooking * Fix ruff line-length lint in intercept-legacy-python hook Run ruff format to properly break long lines into multi-line tuples. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Rewrite legacy Python hook in shell for performance Replace tree-sitter-based Python implementation with a shell script using jq and regex patterns. This eliminates the overhead of spawning Python and loading tree-sitter on every Bash command. - Use jq for JSON parsing (fast, commonly available) - Regex-based pattern matching for python/pip commands - Allow uv run commands to pass through - Context-aware suggestions based on subcommand - Passes shellcheck validation Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Allow diagnostic commands and simplify error message - Skip `which`, `type`, `whereis`, `command -v` for python/pip - Simplify denial message (Claude already knows uv commands) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Allow search tools through legacy Python hook Add allowlist for grep, rg, ag, ack, find to prevent false positives when searching for "python" or "pip" as text patterns. Also normalize character class ordering for consistency with other patterns. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Fix shfmt formatting (2-space indent) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Add hook development guidance to CLAUDE.md Document design lessons from PR #40's Python-to-shell rewrite: - Performance: prefer shell+jq over Python with dependencies - Simplicity: accept false positives when performance gain is worth it - False positive awareness: diagnostic commands, search tools, filenames - Explicit tradeoff documentation in PR descriptions Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Refine CLAUDE.md formatting for consistent density Remove section breaks (horizontal rules) between major sections and condense the Hooks section from verbose multi-paragraph format into a unified list while preserving all guidance. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: Dan Guido <dan@trailofbits.com>
2026-01-26 19:03:08 -05:00
"hooks": {
use PATH shim override technique instead of hooking every pre tool usage (#89) * use PATH shim override technique instead of hooking every pre tool usage * remove unecessary check * fix: resolve code review findings for PR #89 P1 fixes: - setup-shims.sh: Add CLAUDE_ENV_FILE guard to prevent opaque 'unbound variable' crash when env var is unset (matches gh-cli plugin pattern) P2 fixes: - setup-shims.sh: Guard shims_dir resolution failure to prevent empty PATH prefix on partial installs - shims/uv: Fix shfmt formatting (here-string spacing) - shims/uv: Resolve PATH entries before comparison to prevent exec loop with symlinked/unnormalized paths - shims/uv: Use ${PATH:-} to handle unset PATH defensively - setup-shims.bats: Add test for unset CLAUDE_ENV_FILE - uv-shim.bats: Add test for 'real uv not found' error path P3 dismissed: - CI linting gap for extensionless shim scripts: accepted as-is since shims must masquerade as real binaries (no .sh extension); manual review covers these files - Unset PATH in uv shim: addressed by ${PATH:-} fix above All 27 bats tests pass. shellcheck and shfmt clean. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Dan Guido <dan@trailofbits.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-12 22:16:40 -05:00
"SessionStart": [
Add hook to modern-python to intercept python3 and pip calls (#40) * Add hook to modern-python to intercept python3 and pip calls Uses tree-sitter-bash parse the AST for more robust hooking * Fix ruff line-length lint in intercept-legacy-python hook Run ruff format to properly break long lines into multi-line tuples. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Rewrite legacy Python hook in shell for performance Replace tree-sitter-based Python implementation with a shell script using jq and regex patterns. This eliminates the overhead of spawning Python and loading tree-sitter on every Bash command. - Use jq for JSON parsing (fast, commonly available) - Regex-based pattern matching for python/pip commands - Allow uv run commands to pass through - Context-aware suggestions based on subcommand - Passes shellcheck validation Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Allow diagnostic commands and simplify error message - Skip `which`, `type`, `whereis`, `command -v` for python/pip - Simplify denial message (Claude already knows uv commands) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Allow search tools through legacy Python hook Add allowlist for grep, rg, ag, ack, find to prevent false positives when searching for "python" or "pip" as text patterns. Also normalize character class ordering for consistency with other patterns. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Fix shfmt formatting (2-space indent) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Add hook development guidance to CLAUDE.md Document design lessons from PR #40's Python-to-shell rewrite: - Performance: prefer shell+jq over Python with dependencies - Simplicity: accept false positives when performance gain is worth it - False positive awareness: diagnostic commands, search tools, filenames - Explicit tradeoff documentation in PR descriptions Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Refine CLAUDE.md formatting for consistent density Remove section breaks (horizontal rules) between major sections and condense the Hooks section from verbose multi-paragraph format into a unified list while preserving all guidance. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: Dan Guido <dan@trailofbits.com>
2026-01-26 19:03:08 -05:00
{
use PATH shim override technique instead of hooking every pre tool usage (#89) * use PATH shim override technique instead of hooking every pre tool usage * remove unecessary check * fix: resolve code review findings for PR #89 P1 fixes: - setup-shims.sh: Add CLAUDE_ENV_FILE guard to prevent opaque 'unbound variable' crash when env var is unset (matches gh-cli plugin pattern) P2 fixes: - setup-shims.sh: Guard shims_dir resolution failure to prevent empty PATH prefix on partial installs - shims/uv: Fix shfmt formatting (here-string spacing) - shims/uv: Resolve PATH entries before comparison to prevent exec loop with symlinked/unnormalized paths - shims/uv: Use ${PATH:-} to handle unset PATH defensively - setup-shims.bats: Add test for unset CLAUDE_ENV_FILE - uv-shim.bats: Add test for 'real uv not found' error path P3 dismissed: - CI linting gap for extensionless shim scripts: accepted as-is since shims must masquerade as real binaries (no .sh extension); manual review covers these files - Unset PATH in uv shim: addressed by ${PATH:-} fix above All 27 bats tests pass. shellcheck and shfmt clean. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Dan Guido <dan@trailofbits.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-12 22:16:40 -05:00
"matcher": "",
Add hook to modern-python to intercept python3 and pip calls (#40) * Add hook to modern-python to intercept python3 and pip calls Uses tree-sitter-bash parse the AST for more robust hooking * Fix ruff line-length lint in intercept-legacy-python hook Run ruff format to properly break long lines into multi-line tuples. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Rewrite legacy Python hook in shell for performance Replace tree-sitter-based Python implementation with a shell script using jq and regex patterns. This eliminates the overhead of spawning Python and loading tree-sitter on every Bash command. - Use jq for JSON parsing (fast, commonly available) - Regex-based pattern matching for python/pip commands - Allow uv run commands to pass through - Context-aware suggestions based on subcommand - Passes shellcheck validation Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Allow diagnostic commands and simplify error message - Skip `which`, `type`, `whereis`, `command -v` for python/pip - Simplify denial message (Claude already knows uv commands) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Allow search tools through legacy Python hook Add allowlist for grep, rg, ag, ack, find to prevent false positives when searching for "python" or "pip" as text patterns. Also normalize character class ordering for consistency with other patterns. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Fix shfmt formatting (2-space indent) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Add hook development guidance to CLAUDE.md Document design lessons from PR #40's Python-to-shell rewrite: - Performance: prefer shell+jq over Python with dependencies - Simplicity: accept false positives when performance gain is worth it - False positive awareness: diagnostic commands, search tools, filenames - Explicit tradeoff documentation in PR descriptions Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Refine CLAUDE.md formatting for consistent density Remove section breaks (horizontal rules) between major sections and condense the Hooks section from verbose multi-paragraph format into a unified list while preserving all guidance. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: Dan Guido <dan@trailofbits.com>
2026-01-26 19:03:08 -05:00
"hooks": [
{
"type": "command",
Remove legacy codex compatiblity scripts/shims. (#173) * Remove legacy codex compatiblity scripts/shims. Codex supports claude plugins so this shouldn't be necessary. Add a script to test the plugin loadablility in both claude and codex * fix: resolve code review findings for PR #173 Review findings addressed (4 reviewers: pr-review-toolkit agents, Codex gpt-5.3-codex, direct diff review): P2 fixed: - Bump versions for the 5 substantively changed plugins in both plugin.json and marketplace.json (gh-cli 1.5.0 new skill, claude-in-chrome-troubleshooting 1.1.0 skill rename, modern-python 1.5.1 / skill-improver 1.0.3 hooks change, zeroize-audit 0.1.1 MCP config relocation) so clients pick up the changes - README Codex install: replace unpasteable /plugins slash-command block with verified CLI syntax (codex plugin marketplace add) - check_claude_loadability: parse_json_output now fails fast with command context on empty CLI output instead of returning None - check_codex_loadability: surface skipped RPC error messages in timeout failures instead of a bare TimeoutError P3 fixed: - Both checkers: error out when marketplace.json lists no plugins instead of passing vacuously Dismissed: - @latest CLI installs in validate.yml: deliberate; the check validates against the clients users actually run - select.select portability: CI-only script on ubuntu-latest - Divergent mcpServers validation between checkers: intentional; the Codex checker enforces the repo's .mcp.json convention Verified: ruff, prek, validate_plugin_metadata.py, and both loadability checks pass end-to-end (39 plugins, 74 skills, 2 MCP servers load in Claude Code and Codex) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Dan Guido <dan@trailofbits.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-05 12:18:09 -04:00
"command": "bash \"${CLAUDE_PLUGIN_ROOT:-.}/hooks/setup-shims.sh\""
Add hook to modern-python to intercept python3 and pip calls (#40) * Add hook to modern-python to intercept python3 and pip calls Uses tree-sitter-bash parse the AST for more robust hooking * Fix ruff line-length lint in intercept-legacy-python hook Run ruff format to properly break long lines into multi-line tuples. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Rewrite legacy Python hook in shell for performance Replace tree-sitter-based Python implementation with a shell script using jq and regex patterns. This eliminates the overhead of spawning Python and loading tree-sitter on every Bash command. - Use jq for JSON parsing (fast, commonly available) - Regex-based pattern matching for python/pip commands - Allow uv run commands to pass through - Context-aware suggestions based on subcommand - Passes shellcheck validation Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Allow diagnostic commands and simplify error message - Skip `which`, `type`, `whereis`, `command -v` for python/pip - Simplify denial message (Claude already knows uv commands) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Allow search tools through legacy Python hook Add allowlist for grep, rg, ag, ack, find to prevent false positives when searching for "python" or "pip" as text patterns. Also normalize character class ordering for consistency with other patterns. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Fix shfmt formatting (2-space indent) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Add hook development guidance to CLAUDE.md Document design lessons from PR #40's Python-to-shell rewrite: - Performance: prefer shell+jq over Python with dependencies - Simplicity: accept false positives when performance gain is worth it - False positive awareness: diagnostic commands, search tools, filenames - Explicit tradeoff documentation in PR descriptions Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Refine CLAUDE.md formatting for consistent density Remove section breaks (horizontal rules) between major sections and condense the Hooks section from verbose multi-paragraph format into a unified list while preserving all guidance. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: Dan Guido <dan@trailofbits.com>
2026-01-26 19:03:08 -05:00
}
]
}
]
}
}
Reference in New Issue Copy Permalink