ship-safe-hooks

name	ship-safe-hooks
description	Install ship-safe as real-time Claude Code hooks — blocks secrets and dangerous commands before they land on disk. Use when the user wants automatic security scanning on every file write or bash command.
argument-hint	[install|remove|status]

Ship Safe — Claude Code Hooks

You are installing ship-safe as real-time security hooks into Claude Code. Once installed, ship-safe will:

• Block Write / Edit / MultiEdit calls that contain critical secrets (API keys, tokens, private keys) before they are written to disk
• Block Bash calls matching dangerous patterns (curl piped to shell, credential exfiltration)
• Scan every file after it is written and inject advisory findings directly into this conversation
• Show a local Protected by Ship Safe status line in Claude Code when both hooks are ready

Step 1: Determine the action

If $ARGUMENTS is remove: run the remove command below. If $ARGUMENTS is status: run the status command below. Otherwise (default or install): run the install command.

Step 2: Run the command

Install (default):

npx ship-safe@latest hooks install

Remove:

npx ship-safe@latest hooks remove

Status check:

npx ship-safe@latest hooks status

Step 3: Report the result

On install success:

• Confirm that two hooks are now registered in ~/.claude/settings.json
• Confirm that the Ship Safe status line is registered as well, unless another status line already exists
• Explain what each hook does:
  • PreToolUse (on Write / Edit / MultiEdit / Bash): blocks critical secrets and dangerous commands in real time
  • PostToolUse (on Write / Edit / MultiEdit): scans the written file and reports findings in context
• Tell the user that no restart is needed — hooks take effect immediately
• The status line is a local indicator backed by the installed hooks; it is not a decorative claim

On remove success:

• Confirm the hooks were removed from ~/.claude/settings.json

On status:

• Report which hooks are installed (✔) and which are missing (✗)
• If any are missing, offer to run install

On error:

• If the command fails, check whether Node.js 18+ is available: node --version
• If hook scripts are missing, suggest reinstalling: npm install -g ship-safe

Notes

• Hooks are stored in ~/.claude/settings.json (global) so they apply to all Claude Code projects
• The hooks are non-invasive: they only read file content and run patterns locally — no data is sent externally
• PostToolUse never blocks, it only informs
• To see what was installed: cat ~/.claude/settings.json