When to use this
- When processing untrusted external content that might contain embedded instructions targeting Claude
- When Claude reads web pages, emails, or user-submitted text that could carry injection payloads
- As a first-line defense before any tool call that processes external data sources
How to use
-
Open the template on GitHub and copy its content:
hooks/bash/prompt-injection-detector.sh -
Place the file inside
.claude/hooks/in your project (or globally in~/.claude/to share across all projects). For shell scripts, make it executable:chmod +x prompt-injection-detector.sh - Review each command in the script, adjust paths and thresholds for your environment, then test it in a safe context before wiring it into hooks.