Claude Code Safety Hooks — Development skill for Claude Code

Claude Code Safety Hooks

Production-tested safety primitives for [Claude Code](https://docs.anthropic.com/en/docs/claude-code) agents. Extracted from [JFDIBot](https://jfdi.bot), an AI executive assistant that manages email, membership platforms, DNS, and shell access for a real business.

Read the full write-up: [Every Unlocked Door Needs a Security System](https://jfdi.bot/blog/every-unlocked-door-needs-a-security-system)

Three layers of defense

These components implement a layered defense model. Each layer is independent - none of them trust the others.

Layer 1: Instruction-source separation (behavioral)

**File:** [`includes/untrusted-content-defense.md`](includes/untrusted-content-defense.md)

A set of rules loaded into your agent's context that establish a foundational principle: the user's messages are instructions, everything fetched from outside is data. Covers authority claims, override language, exfiltration requests, and encoded payloads.

This is the weakest layer because it depends on the AI following instructions correctly. A sufficiently clever injection could slip through.

Layer 2: Architectural isolation (structural)

When your agent processes external content, route it through a sandboxed sub-agent that extracts what's useful and returns a summary. The main agent that has access to tools and systems never sees the raw external content. An injection has to survive two hops - influencing the sandboxed processor, then re-injecting through the summary into the main agent's decision-making.

This repo doesn't include a turnkey implementation of Layer 2 (it depends on your agent architecture), but the [blog post](https://jfdi.bot/blog/how-jfdibot-protects-against-content-injection-and-destructive-actions) describes the pattern in detail.

Layer 3: Deterministic command guard (code, no AI)

**File:** [`hooks/dangerous-command-guard.sh`](hooks/dangerous-command-guard.sh)

A bash script that runs as a [PreToolUse hook](https://docs.an