scrub

Defined in hooks/hooks.json

{
  "PreToolUse": [
    {
      "hooks": [
        {
          "type": "command",
          "command": "bash \"$CLAUDE_PLUGIN_ROOT/scripts/guard-secrets.sh\"",
          "timeout": 5
        }
      ],
      "matcher": "Read"
    }
  ],
  "PostToolUse": [
    {
      "hooks": [
        {
          "type": "command",
          "command": "bash -c 'FILE=\"$TOOL_INPUT_FILE_PATH\"; EXT=\"${FILE##*.}\"; EXT=\"${EXT,,}\"; if [[ \"$EXT\" =~ ^(jpg|jpeg|png|heic|webp|tiff|tif)$ ]] && command -v exiftool &>/dev/null; then exiftool -overwrite_original -gps:all= -xmp:geotag= -exif:gpsinfo= \"$FILE\" 2>/dev/null && echo \"[scrub] Auto-removed GPS from: $FILE\"; fi'",
          "timeout": 10
        },
        {
          "type": "command",
          "command": "bash -c 'FILE=\"$TOOL_INPUT_FILE_PATH\"; EXT=\"${FILE##*.}\"; EXT=\"${EXT,,}\"; if [[ \"$EXT\" =~ ^(js|ts|jsx|tsx|py|rb|go|java|php|sh|yaml|yml|json|env|config|cfg|ini|toml)$ ]]; then if grep -qE \"(sk-[a-zA-Z0-9]{20,}|sk-ant-|AKIA[0-9A-Z]{16}|ghp_[0-9a-zA-Z]{36}|-----BEGIN.*PRIVATE KEY-----)\" \"$FILE\" 2>/dev/null; then echo \"[scrub] ⚠️  Secrets detected in $FILE - run /scrub:secrets\"; fi; fi'",
          "timeout": 5
        }
      ],
      "matcher": "Write"
    }
  ]
}

{
  "riskFlags": {
    "touchesBash": false,
    "matchAllTools": false,
    "touchesFileWrites": true
  },
  "typeStats": {
    "command": 3
  },
  "eventStats": {
    "PreToolUse": 1,
    "PostToolUse": 2
  },
  "originCounts": {
    "absolutePaths": 0,
    "pluginScripts": 0,
    "projectScripts": 0
  },
  "timeoutStats": {
    "commandsWithoutTimeout": 0
  }
}