Shell Wrapper Guard
Detects destructive commands hidden inside shell wrappers (sh -c, bash -c, python3 -c, node -e, perl -e, ruby -e). Complements dangerous-command-blocker by catching bypass vectors like 'sh -c "rm -rf /"' that evade direct command checks. Covers 8 bypass patterns: interpreter one-liners, nested wrappers, pipe-to-shell, here-strings, and env-based wrappers.
npx claude-code-templates@latest --hook security/shell-wrapper-guard Scanned by NVIDIA SkillSpector
Automated static analysis (no LLM) · v2.12.0 · 2026-10-17
SkillSpector looks for patterns such as shell commands, credential access, network calls or unpinned dependencies. An observation is something worth reading in the files before you install, not a confirmed vulnerability. Components that run code locally, like hooks, MCP servers and security tooling, naturally show more of them.
- Tool Parameter Abuse ×2Tool Misuse · SKILL.md:3
- Tool Parameter Abuse ×2Tool Misuse · shell-wrapper-guard.json:2
- Tool Parameter Abuse ×16Tool Misuse · shell-wrapper-guard.sh:5
- Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: shell.MCP Least Privilege · SKILL.md:1
Learn more about NVIDIA SkillSpector.