schlock

schlock

A safety net for Claude Code — Intercepts dangerous bash commands before they execute.

Features: AST-based parsing (plus regex) · 60+ security rules · 3 risk presets · Audit logging · Commit ad-blocker

Quick Start · How It Works · Configuration · Docs

---

The Problem

You're using Claude Code with Bash(*) permissions because you want it to actually get things done. But then it does this:

Claude: I'll clean up those temp files for you.
Claude: Bash(`rm -rf project-*`)

While you're thinking: "Wait, which directory am I in? What else matches that glob? Did I have anything important in there?" it's already too late.

Or worse:

Claude: Let me fix that git history.
Claude: Bash(`git reset --hard HEAD~5`)
Claude: Bash(`git push --force origin main`)

By the time you've processed what happened, it's done. Your git history is rewritten. Your team is not happy.

The Solution

schlock is a Claude Code plugin that intercepts every bash command and blocks the dangerous ones before they execute.

Claude: Bash(`rm -rf /`)
┌─────────────────────────────────────────────────────┐
│ 🚫 BLOCKED by schlock                               │
│                                                     │
│ Command: rm -rf /                                   │
│ Risk: BLOCKED - Recursive delete from root          │
│                                                     │
│ This command would delete your entire filesystem.   │
│ If you actually need to do this, run it manually.   │
└─────────────────────────────────────────────────────┘

Claude sees the rejection and adjusts. Your filesystem survives. You sleep at night.

---

Quick Start

# In Claude Code
/plugin marketplace add 27Bslash6/schlock
/plugin install schlock@schlock

# Optional
/schlock:setup

That's it. Safety validation is automatic. The setup wizard configures to your liking.

Recommended: Install ShellCheck for enhanced security detection:

# macOS
brew install shellcheck

# Linux
apt-get install shellcheck  # or: dnf install ShellCheck

ShellCheck catches command injection, format string vulnerabilities, and the infamous "MongoDB disaster" pattern (rm -rf $EMPTY_VAR/* → rm -rf /*). schlock integrates automatically when ShellCheck is available.

Zero friction: <1ms validation on most commands. You won't notice it's there.

Team installation: Add to .claude/settings.json and commit — teammates get it automatically when they trust the repo. See docs/INSTALLING.md.

---

How It Works

┌──────────────┐     ┌──────────────┐     ┌──────────────┐
│ Claude wants │     │   schlock    │     │   Command    │
│ to run bash  │ ──▶ │  validates   │ ──▶ │   executes   │
│   command    │     │   command    │     │  (or not)    │
└──────────────┘     └──────────────┘     └──────────────┘
                            │
                     ┌──────┴──────┐
                     │             │
                 ┌───▼───┐    ┌───▼───┐
                 │ Parse │    │ Match │
                 │  AST  │    │ Rules │
                 └───────┘    └───────┘

1. Hook: schlock registers a PreToolUse hook with Claude Code
2. Parse: When Claude calls Bash(), schlock parses the command using bashlex (proper AST, not regex)
3. Match: The parsed command is checked against 40+ security rules
4. Decide: Commands are allowed, warned, or blocked based on risk level
5. Log: Every decision is logged to ~/.config/schlock/audit.jsonl

Why AST parsing matters: Regex-based blockers are trivially bypassed. rm -rf / is easy to catch, but what about r\m -rf / or $(echo rm) -rf /? bashlex parses the actual shell semantics, not string patterns.

---

What Gets Caught

Every command is classified into a risk level:

Risk Level	What	Examples
🚫 BLOCKED	System destruction, credential exposure	rm -rf /, chmod 000 /, cat ~/.ssh/id_rsa
⚠️ HIGH	History rewriting, broad permissions	git push --force, chmod 777, sudo rm
⚡ MEDIUM	Risky patterns	curl | sh, eval "$var"
ℹ️ LOW	Potentially slow/resource-intensive	find / -name, dd if=/dev
✅ SAFE	Read-only operations	ls, git status, cat file.txt