The PreToolUse bash-check hook denies unsafe commands when they are issued directly, but allows equivalent commands wrapped in bash -c, sh -c, eval, or command substitution.
The hook evaluates the outer command instead of the command that will execute, so users can receive an allow verdict for behavior the safety hook is intended to deny.
The PreToolUse
bash-checkhook denies unsafe commands when they are issued directly, but allows equivalent commands wrapped inbash -c,sh -c,eval, or command substitution.The hook evaluates the outer command instead of the command that will execute, so users can receive an allow verdict for behavior the safety hook is intended to deny.