asamassekou10/ship-safe-hooks
claude-code-plugin/skills/ship-safe-hooks/SKILL.md
Install ship-safe as real-time Claude Code hooks — blocks secrets and dangerous commands before they land on disk. Use when the user wants automatic security scanning on every file write or bash command.
$ install --global
skillsauthnpx skillsauth add asamassekou10/ship-safe ship-safe-hooksInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 24, 2026, 8:53 PM1.8s1 file scanned
SKILL.md
- name:
- ship-safe-hooks
- description:
- Install ship-safe as real-time Claude Code hooks — blocks secrets and dangerous commands before they land on disk. Use when the user wants automatic security scanning on every file write or bash command.
- argument-hint:
- [install|remove|status]
Ship Safe — Claude Code Hooks
You are installing ship-safe as real-time security hooks into Claude Code. Once installed, ship-safe will:
- Block
Write/Edit/MultiEditcalls that contain critical secrets (API keys, tokens, private keys) before they are written to disk - Block
Bashcalls matching dangerous patterns (curl piped to shell, credential exfiltration) - Scan every file after it is written and inject advisory findings directly into this conversation
Step 1: Determine the action
If $ARGUMENTS is remove: run the remove command below.
If $ARGUMENTS is status: run the status command below.
Otherwise (default or install): run the install command.
Step 2: Run the command
Install (default):
npx ship-safe@latest hooks install
Remove:
npx ship-safe@latest hooks remove
Status check:
npx ship-safe@latest hooks status
Step 3: Report the result
On install success:
- Confirm that two hooks are now registered in
~/.claude/settings.json - Explain what each hook does:
- PreToolUse (on Write / Edit / MultiEdit / Bash): blocks critical secrets and dangerous commands in real time
- PostToolUse (on Write / Edit / MultiEdit): scans the written file and reports findings in context
- Tell the user that no restart is needed — hooks take effect immediately
On remove success:
- Confirm the hooks were removed from
~/.claude/settings.json
On status:
- Report which hooks are installed (✔) and which are missing (✗)
- If any are missing, offer to run
install
On error:
- If the command fails, check whether Node.js 18+ is available:
node --version - If hook scripts are missing, suggest reinstalling:
npm install -g ship-safe
Notes
- Hooks are stored in
~/.claude/settings.json(global) so they apply to all Claude Code projects - The hooks are non-invasive: they only read file content and run patterns locally — no data is sent externally
- PostToolUse never blocks, it only informs
- To see what was installed:
cat ~/.claude/settings.json
Related Skills
asamassekou10/ship-safe
tools
VerifiedTrustedCommunity
Run a full security audit on this project — 16 agents scan for secrets, injections, auth bypass, SSRF, supply chain, Supabase RLS, MCP security, agentic AI, RAG poisoning, PII compliance, and more. Use when the user wants a security audit, vulnerability scan, or asks if their code is safe to ship.
420SKILL.mdUpdated Apr 16, 2026
asamassekou10/ship-safe-score
development
VerifiedTrustedCommunity
Get your project's security health score (0-100, A-F grade). Use when the user wants a quick security check or asks "is my code safe to ship?"
420SKILL.mdUpdated Apr 16, 2026
asamassekou10/ship-safe-scan
development
VerifiedTrustedCommunity
Quick scan for leaked secrets — API keys, passwords, tokens, database URLs. Use when the user wants to check for hardcoded secrets or exposed credentials.
420SKILL.mdUpdated Apr 16, 2026
asamassekou10/ship-safe-red-team
tools
VerifiedTrustedCommunity
Run a multi-agent red team scan — 16 specialized security agents scan for 80+ attack classes including injection, auth bypass, SSRF, supply chain, Supabase RLS, MCP security, agentic AI, RAG poisoning, PII compliance, and more. Use when the user wants a deep security analysis beyond just secrets.
420SKILL.mdUpdated Apr 16, 2026