mourad-ghafiri

Claude Guard Hook — Data skill for Claude Code

Data community

A global Claude Code hook that intercepts sensitive data before it reaches the LLM — secrets, API keys, PII, and system info.

How to install Claude Guard Hook

This entry records only its repository, not the path inside it, so there is no exact command to give. Open mourad-ghafiri/claude-guard-hook and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Claude Guard Hook does

A global Claude Code hook that intercepts sensitive data before it reaches the LLM — secrets, API keys, PII, and system info.

Alternatives in Data

Azure Cosmos DB .net — Cosmos DB NoSQL with global distribution 1.8k ★
Global Stock Data — US stock market data for AI coding assistants — zero-auth, official sources 1.5k ★
Query Token Info — Search tokens and fetch metadata, real-time market data, and K-Line candlestick charts by keyword or contract 483 ★

README

claude-guard

A global Claude Code hook that intercepts sensitive data before it reaches the LLM — secrets, API keys, PII, and system info are replaced with `{{GUARD:...}}` placeholders. When Claude writes back, real values are transparently restored.

**Note**: This is a **hook**, not a plugin. Hooks intercept Claude's built-in tools (Read, Write, Bash) via `~/.claude/settings.json`. They work silently in the background.

Quick start

git clone https://github.com/mourad-ghafiri/claude-guard-hook
cd claude-guard-hook
npm run guard:install

**Restart Claude Code after installing.**

Usage

npm run guard              # Interactive menu (recommended)
npm run guard:install      # Install
npm run guard:uninstall    # Uninstall
npm run guard:reload       # Rebuild + apply changes
npm run guard status       # Show status
npm run guard patterns     # List all patterns
npm run guard help         # All commands

How it works

User prompt ──> [UserPromptSubmit] ──> redact secrets → {{GUARD:...}}
                                       feedback: "⚠ redacted 2 secret(s)"

File read   ──> [PreToolUse Read]  ──> block protected files (mock content)
                                       redact secrets + system info

File write  ──> [PreToolUse Write] ──> restore {{GUARD:...}} → real values

Bash cmd    ──> [PreToolUse Bash]  ──> restore placeholders in commands
                                       block env dumps + protected files

Strategies

Strategy	Result	Reversible	When to use
`placeholder`	`{{GUARD:Name:hex}}`	Yes	Default. Round-trips safely through Claude
`mask`	`[REDACTED]`	No	Hide completely, no trace
`replace`	Custom `replaceBy` value	No	Swap with a safe alternative

Patterns

All 48 patterns live in `config/default-config.json` — one flat list. Each pattern has `id`, `name`, `pattern` (regex), `category`, `enabled`, `redactionStrat