agent-sanitizer

Five hooks over everything crossing a Claude Code session. SessionStart scans the instruction files that load at launch — CLAUDE.md, AGENTS.md, the .claude/ context files and the CLAUDE.md chain above the project — for hidden-Unicode payloads and cleans what it can. InstructionsLoaded scans every other instruction file at the moment Claude Code loads it, so a nested CLAUDE.md or a path-scoped rule is checked without walking the tree at startup. UserPromptSubmit blocks prompts carrying payload-capable invisible Unicode or ANSI escapes. PreToolUse normalizes confusable paths and commands and strips stego and terminal-control sequences from model-authored content. PostToolUse strips invisibles and ANSI, splices hidden HTML out of web and MCP output, and flags exfil-shaped URLs — a hex value one digest wide is exempt under a generic parameter name, and AGENT_SANITIZER_FLAG_DIGEST_VALUES=1 reports it too. Secret redaction via detect-secrets is opt-in (AGENT_SANITIZER_SECRETS_ENABLED=1). A hook that cannot run passes the guarded action through with a loud warning by default; AGENT_SANITIZER_FAIL_OPEN=0 makes it block instead, and AGENT_SANITIZER_DISABLED_HOOKS turns individual hooks off. All local and deterministic: no inference key is read and no request leaves the machine.

1 skill · hooks