メニュー
Probe ${VAR} substitution allowlist in skill body (§1.2). Tests CLAUDE_PLUGIN_ROOT/DATA/SKILL_DIR/SESSION_ID/PROJECT_DIR substitution at invoke time.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Mac Cowork で、plugin-level SessionStart hook(host 側)から $CLAUDE_PLUGIN_DATA に書いた値が「別の chat session を跨いで」残るかを検証する probe。書き込み＆読み戻しは hook(persist.sh)側で行い、その結果は SessionStart の stdout として context に出る。この skill body は対比用に「VM Bash 側から DATA が見えるか／hook が書いたファイルを読めるか」を確認する。
Surfaces UPE_PROBE_* marker lines to test whether the plugin-level UserPromptExpansion hook fires on Cowork. Invoking this skill via slash is itself the trigger; compares against UserPromptSubmit and SessionStart controls.
Triggers the plugin-level PreToolUse hooks by running a sentinel bash command, to test (via session export) whether Cowork runs PreToolUse hook commands through cmd.exe or a POSIX shell, and whether the inline block pattern actually blocks the bash tool.
Surfaces the EXEC_* marker lines emitted by the plugin-level SessionStart hooks, which run hook commands in EXEC FORM (args present). Used to test whether exec form resolves ${CLAUDE_PLUGIN_ROOT} to a real path and exports it as an env var on Cowork, where shell form (§2.1/§2.2) failed both.
Shows what skill-body CLAUDE_PLUGIN_ROOT and friends substitute to on Mac Cowork, whether the VM Bash tool can use that path, and whether the Read tool can read a bundled file at that host path.
Proves whether a skill frontmatter PreToolUse Bash hook fires on Cowork by emitting only a block decision (no echo). A marked bash should be blocked even though no frontmatter stdout surfaces.
| name | 02-substitution-allowlist |
| description | Probe ${VAR} substitution allowlist in skill body (§1.2). Tests CLAUDE_PLUGIN_ROOT/DATA/SKILL_DIR/SESSION_ID/PROJECT_DIR substitution at invoke time. |
| user-invocable | true |
| hooks | {"PreToolUse":[{"matcher":"Bash","hooks":[{"type":"command","command":"sid=\"${CLAUDE_SESSION_ID:-no-sid}\"; ver=\"${VERIFIER_VERSION_DIR:-v-unknown}\"; out_dir=\"$CLAUDE_PROJECT_DIR/findings/$ver/$sid\"; mkdir -p \"$out_dir\"; printf \"[02-FM %s] tag=fm-registered\\n\" \"$(date -Iseconds)\" >> \"$out_dir/probe.log\""}]}]} |
§1.2 で予測される置換結果（skill body）：
| 記法 | 期待 |
|---|---|
${CLAUDE_PLUGIN_ROOT} | 絶対 path |
${CLAUDE_PLUGIN_DATA} | 絶対 path |
${CLAUDE_SKILL_DIR} | SKILL.md の dirname の絶対 path |
${CLAUDE_SESSION_ID} | UUID |
${CLAUDE_PROJECT_DIR} | literal のまま残る |
${VAR} を skill body で echoproj="${CLAUDE_PROJECT_DIR:-$PWD}"
ver="${VERIFIER_VERSION_DIR:-v-unknown}"
sid="${CLAUDE_SESSION_ID:-no-sid}"
out_dir="$proj/findings/$ver/$sid"
mkdir -p "$out_dir"
{
printf '[02-BODY %s] tag=alive-check\n' "$(date -Iseconds)"
printf '[02-BODY] SUBST_ROOT=[${CLAUDE_PLUGIN_ROOT}]\n'
printf '[02-BODY] SUBST_DATA=[${CLAUDE_PLUGIN_DATA}]\n'
printf '[02-BODY] SUBST_SKILL_DIR=[${CLAUDE_SKILL_DIR}]\n'
printf '[02-BODY] SUBST_SESSION_ID=[${CLAUDE_SESSION_ID}]\n'
printf '[02-BODY] SUBST_PROJECT_DIR=[${CLAUDE_PROJECT_DIR}]\n'
} | tee -a "$out_dir/probe.log"
proj="${CLAUDE_PROJECT_DIR:-$PWD}"
ver="${VERIFIER_VERSION_DIR:-v-unknown}"
echo "=== install.log (search for validator block) ==="
grep -E "plugin-only|CLAUDE_PLUGIN_DATA|skill hooks|Bad substitution" "$proj/findings/$ver/install.log" 2>&1 || echo "no install.log yet (run install-marketplace.sh first)"
echo
echo "=== probe.log tail ==="
sid="${CLAUDE_SESSION_ID:-no-sid}"
tail -n 30 "$proj/findings/$ver/$sid/probe.log"
完了したら exit。./scripts/assert.sh 02。