by Karan Bansal
A prompt-injection tripwire for instruction files. An InstructionsLoaded hook audits CLAUDE.md / .claude/rules/*.md content as it enters context and flags hidden or hostile directives: invisible Unicode smuggling (zero width characters, tag characters, variation-selector runs; the TrapDoor supply-chain signature), bidi overrides, directives to read or exfiltrate secrets, curl|sh, decode-and-execute, and hook/settings tampering. Because current builds cannot block on that event, the same script also registers on UserPromptSubmit and PreToolUse as the enforcement arm: a finding locks the session and every prompt and tool call is denied until a human fixes the file or clears the named lock. Tune via HOOK_AUDIT_LEVEL (critical/high/strict) and HOOK_AUDIT_WARN_ONLY, no file edits needed.
Claude Code