instructions-audit

v1.0.0

A prompt-injection tripwire for instruction files. An InstructionsLoaded hook audits CLAUDE.md / .claude/rules/*.md content as it enters context and flags hidden or hostile directives: invisible Unicode smuggling (zero width characters, tag characters, variation-selector runs; the TrapDoor supply-chain signature), bidi overrides, directives to read or exfiltrate secrets, curl|sh, decode-and-execute, and hook/settings tampering. Because current builds cannot block on that event, the same script also registers on UserPromptSubmit and PreToolUse as the enforcement arm: a finding locks the session and every prompt and tool call is denied until a human fixes the file or clears the named lock. Tune via HOOK_AUDIT_LEVEL (critical/high/strict) and HOOK_AUDIT_WARN_ONLY, no file edits needed.

Claude Code

By Karan BansalLicense: MIT533 GitHub starsUpdated 2 weeks ago

Directory evidence

Runtimes: Claude Code
Parsed components: 0 skill or MCP entries
Source updated: Oct 4, 2026
Manifest status: Canonical path parsed

The directory validates manifest shape and source location. It does not execute the plugin or provide a security endorsement. Review the indexing methodology →

Install instructions-audit for Claude Code

Installs for the current user

claude plugin marketplace add IchenDEV/agent-plugin-mkt
claude plugin marketplace update agent-plugin-marketplace
claude plugin install instructions-audit@agent-plugin-marketplace

Paste and run these commands in a terminal with Claude Code. They add and refresh the PluginsMP catalog, then install this plugin.

The installer fetches third-party code from the source repository shown on this page. This directory validates manifest structure and source location, but does not perform a security audit; review the manifest, components, and source before installing.

Get the source manually

$ git clone https://github.com/karanb192/claude-code-hooks

Clone the source repository, then follow its setup instructions to add the plugin to a compatible client. The plugin root is plugins/instructions-audit/.

Plugin files

plugins/instructions-audit/

└── .claude-plugin/plugin.json

Plugin manifests1

plugins/instructions-audit/.claude-plugin/plugin.json

{
  "name": "instructions-audit",
  "description": "A prompt-injection tripwire for instruction files. An InstructionsLoaded hook audits CLAUDE.md / .claude/rules/*.md content as it enters context and flags hidden or hostile directives: invisible Unicode smuggling (zero width characters, tag characters, variation-selector runs; the TrapDoor supply-chain signature), bidi overrides, directives to read or exfiltrate secrets, curl|sh, decode-and-execute, and hook/settings tampering. Because current builds cannot block on that event, the same script also registers on UserPromptSubmit and PreToolUse as the enforcement arm: a finding locks the session and every prompt and tool call is denied until a human fixes the file or clears the named lock. Tune via HOOK_AUDIT_LEVEL (critical/high/strict) and HOOK_AUDIT_WARN_ONLY, no file edits needed.",
  "version": "1.0.0",
  "author": {
    "name": "Karan Bansal",
    "url": "https://github.com/karanb192"
  },
  "homepage": "https://github.com/karanb192/claude-code-hooks",
  "license": "MIT",
  "keywords": [
    "claude-code",
    "hooks",
    "security",
    "prompt-injection",
    "claude-md",
    "guardrails",
    "instructionsloaded",
    "userpromptsubmit",
    "pretooluse"
  ]
}