lintai docs

Appearance

Preset Reference

surface presetdirect activation111 direct rules

claude

Rules for Claude settings and command-hook configuration.

Focus review on shared Claude settings and hook-policy surfaces.

Explicitly turns on this rule set.

Coverage

Covered Rules

SEC340Claude hook: dynamic package launchClaude hook launches an external package dynamically at runtimerecommendedsecurityclaude_settings
SEC341Claude hook: remote content piped to shellClaude settings command hook downloads remote content and pipes it into a shellsupply-chainsecurityclaude_settings
SEC342Claude hook: TLS verification disabledClaude settings command hook disables TLS verification in a network-capable execution pathsupply-chainhardeningclaude_settings
SEC361Claude settings: missing `$schema`Claude settings file is missing a top-level `$schema` referencecompatqualityclaude_settings
SEC362Claude settings: wildcard Bash permissionsClaude settings permissions allow `Bash(*)` in a shared committed configgovernancehardeningclaude_settings
SEC363Claude settings: home-directory hook pathClaude settings hook command uses a home-directory path in a shared committed configcompatqualityclaude_settings
SEC364Claude settings: bypassPermissions default modeClaude settings set `permissions.defaultMode` to `bypassPermissions` in a shared committed configgovernancehardeningclaude_settings
SEC365Claude settings: non-HTTPS allowed HTTP hook URLClaude settings allow non-HTTPS HTTP hook URLs in a shared committed configsupply-chainhardeningclaude_settings
SEC366Claude settings: dangerous HTTP hook host literalClaude settings allow dangerous host literals in `allowedHttpHookUrls`supply-chainhardeningclaude_settings
SEC367Claude settings: wildcard WebFetch permissionsClaude settings permissions allow `WebFetch(*)` in a shared committed configgovernancehardeningclaude_settings
SEC368Claude settings: repo-external absolute hook pathClaude settings hook command uses a repo-external absolute path in a shared committed configcompatqualityclaude_settings
SEC369Claude settings: wildcard Write permissionsClaude settings permissions allow `Write(*)` in a shared committed configgovernancehardeningclaude_settings
SEC372Claude settings: wildcard Read permissionsClaude settings permissions allow `Read(*)` in a shared committed configgovernancehardeningclaude_settings
SEC373Claude settings: wildcard Edit permissionsClaude settings permissions allow `Edit(*)` in a shared committed configgovernancehardeningclaude_settings
SEC374Claude settings: wildcard WebSearch permissionsClaude settings permissions allow `WebSearch(*)` in a shared committed configgovernancehardeningclaude_settings
SEC375Claude settings: wildcard Glob permissionsClaude settings permissions allow `Glob(*)` in a shared committed configgovernancehardeningclaude_settings
SEC376Claude settings: wildcard Grep permissionsClaude settings permissions allow `Grep(*)` in a shared committed configgovernancehardeningclaude_settings
SEC381Claude settings: command hook missing `timeout`Claude settings command hook should set `timeout` in a shared committed configcompatqualityclaude_settings
SEC382Claude settings: `matcher` on unsupported hook eventClaude settings should not use `matcher` on unsupported hook eventscompatqualityclaude_settings
SEC383Claude settings: missing `matcher` on matcher-capable hook eventClaude settings should set `matcher` on matcher-capable hook eventscompatqualityclaude_settings
SEC384Claude settings: bare WebSearch permissionsClaude settings permissions allow bare `WebSearch` in a shared committed configgovernancehardeningclaude_settings
SEC385Claude settings: shared git push permissionsClaude settings permissions allow `Bash(git push)` in a shared committed configgovernancehardeningclaude_settings
SEC386Claude settings: shared git checkout permissionsClaude settings permissions allow `Bash(git checkout:*)` in a shared committed configgovernancehardeningclaude_settings
SEC387Claude settings: shared git commit permissionsClaude settings permissions allow `Bash(git commit:*)` in a shared committed configgovernancehardeningclaude_settings
SEC388Claude settings: shared git stash permissionsClaude settings permissions allow `Bash(git stash:*)` in a shared committed configgovernancehardeningclaude_settings
SEC399Claude settings: shared npx Bash permissionsClaude settings permissions allow `Bash(npx ...)` in a shared committed configgovernancehardeningclaude_settings
SEC400Claude settings: shared enabledMcpjsonServersClaude settings enable `enabledMcpjsonServers` in a shared committed configgovernancehardeningclaude_settings
SEC405Claude settings: shared package install permissionsClaude settings permissions allow package installation commands in a shared committed configgovernancehardeningclaude_settings
SEC406Claude settings: shared git add permissionsClaude settings permissions allow `Bash(git add:*)` in a shared committed configgovernancehardeningclaude_settings
SEC407Claude settings: shared git clone permissionsClaude settings permissions allow `Bash(git clone:*)` in a shared committed configgovernancehardeningclaude_settings
SEC408Claude settings: shared gh pr permissionsClaude settings permissions allow `Bash(gh pr:*)` in a shared committed configgovernancehardeningclaude_settings
SEC409Claude settings: shared git fetch permissionsClaude settings permissions allow `Bash(git fetch:*)` in a shared committed configgovernancehardeningclaude_settings
SEC410Claude settings: shared git ls-remote permissionsClaude settings permissions allow `Bash(git ls-remote:*)` in a shared committed configgovernancehardeningclaude_settings
SEC411Claude settings: shared curl permissionsClaude settings permissions allow `Bash(curl:*)` in a shared committed configgovernancehardeningclaude_settings
SEC412Claude settings: shared wget permissionsClaude settings permissions allow `Bash(wget:*)` in a shared committed configgovernancehardeningclaude_settings
SEC413Claude settings: shared git config permissionsClaude settings permissions allow `Bash(git config:*)` in a shared committed configgovernancehardeningclaude_settings
SEC414Claude settings: shared git tag permissionsClaude settings permissions allow `Bash(git tag:*)` in a shared committed configgovernancehardeningclaude_settings
SEC415Claude settings: shared git branch permissionsClaude settings permissions allow `Bash(git branch:*)` in a shared committed configgovernancehardeningclaude_settings
SEC418Claude settings: shared raw.githubusercontent.com WebFetch permissionsClaude settings permissions allow `WebFetch(domain:raw.githubusercontent.com)` in a shared committed configgovernancehardeningclaude_settings
SEC475Claude settings: unsafe Read path permissionsClaude settings permissions allow `Read(...)` over an unsafe path in a shared committed configgovernancehardeningclaude_settings
SEC476Claude settings: unsafe Write path permissionsClaude settings permissions allow `Write(...)` over an unsafe path in a shared committed configgovernancehardeningclaude_settings
SEC477Claude settings: unsafe Edit path permissionsClaude settings permissions allow `Edit(...)` over an unsafe path in a shared committed configgovernancehardeningclaude_settings
SEC478Claude settings: shared git reset permissionsClaude settings permissions allow `Bash(git reset:*)` in a shared committed configgovernancehardeningclaude_settings
SEC479Claude settings: shared git clean permissionsClaude settings permissions allow `Bash(git clean:*)` in a shared committed configgovernancehardeningclaude_settings
SEC480Claude settings: shared git restore permissionsClaude settings permissions allow `Bash(git restore:*)` in a shared committed configgovernancehardeningclaude_settings
SEC481Claude settings: shared git rebase permissionsClaude settings permissions allow `Bash(git rebase:*)` in a shared committed configgovernancehardeningclaude_settings
SEC482Claude settings: shared git merge permissionsClaude settings permissions allow `Bash(git merge:*)` in a shared committed configgovernancehardeningclaude_settings
SEC483Claude settings: shared git cherry-pick permissionsClaude settings permissions allow `Bash(git cherry-pick:*)` in a shared committed configgovernancehardeningclaude_settings
SEC484Claude settings: shared git apply permissionsClaude settings permissions allow `Bash(git apply:*)` in a shared committed configgovernancehardeningclaude_settings
SEC485Claude settings: shared git am permissionsClaude settings permissions allow `Bash(git am:*)` in a shared committed configgovernancehardeningclaude_settings
SEC486Claude settings: unsafe Glob path permissionsClaude settings permissions allow `Glob(...)` over an unsafe path in a shared committed configgovernancehardeningclaude_settings
SEC487Claude settings: unsafe Grep path permissionsClaude settings permissions allow `Grep(...)` over an unsafe path in a shared committed configgovernancehardeningclaude_settings
SEC488Claude settings: shared uvx Bash permissionsClaude settings permissions allow `Bash(uvx ...)` in a shared committed configgovernancehardeningclaude_settings
SEC489Claude settings: shared pnpm dlx Bash permissionsClaude settings permissions allow `Bash(pnpm dlx ...)` in a shared committed configgovernancehardeningclaude_settings
SEC490Claude settings: shared yarn dlx Bash permissionsClaude settings permissions allow `Bash(yarn dlx ...)` in a shared committed configgovernancehardeningclaude_settings
SEC491Claude settings: shared pipx run Bash permissionsClaude settings permissions allow `Bash(pipx run ...)` in a shared committed configgovernancehardeningclaude_settings
SEC492Claude settings: shared npm exec Bash permissionsClaude settings permissions allow `Bash(npm exec ...)` in a shared committed configgovernancehardeningclaude_settings
SEC493Claude settings: shared bunx Bash permissionsClaude settings permissions allow `Bash(bunx ...)` in a shared committed configgovernancehardeningclaude_settings
SEC502Claude settings: shared gh api POST permissionsClaude settings permissions allow `Bash(gh api --method POST:*)` in a shared committed configgovernancehardeningclaude_settings
SEC503Claude settings: shared gh issue create permissionsClaude settings permissions allow `Bash(gh issue create:*)` in a shared committed configgovernancehardeningclaude_settings
SEC504Claude settings: shared gh repo create permissionsClaude settings permissions allow `Bash(gh repo create:*)` in a shared committed configgovernancehardeningclaude_settings
SEC508Claude settings: shared gh secret set permissionsClaude settings permissions allow `Bash(gh secret set:*)` in a shared committed configgovernancehardeningclaude_settings
SEC509Claude settings: shared gh variable set permissionsClaude settings permissions allow `Bash(gh variable set:*)` in a shared committed configgovernancehardeningclaude_settings
SEC510Claude settings: shared gh workflow run permissionsClaude settings permissions allow `Bash(gh workflow run:*)` in a shared committed configgovernancehardeningclaude_settings
SEC514Claude settings: shared gh secret delete permissionsClaude settings permissions allow `Bash(gh secret delete:*)` in a shared committed configgovernancehardeningclaude_settings
SEC515Claude settings: shared gh variable delete permissionsClaude settings permissions allow `Bash(gh variable delete:*)` in a shared committed configgovernancehardeningclaude_settings
SEC516Claude settings: shared gh workflow disable permissionsClaude settings permissions allow `Bash(gh workflow disable:*)` in a shared committed configgovernancehardeningclaude_settings
SEC528Claude settings: shared gh api DELETE permissionsClaude settings permissions allow `Bash(gh api --method DELETE:*)` in a shared committed configgovernancehardeningclaude_settings
SEC530Claude settings: shared gh api PATCH permissionsClaude settings permissions allow `Bash(gh api --method PATCH:*)` in a shared committed configgovernancehardeningclaude_settings
SEC531Claude settings: shared gh api PUT permissionsClaude settings permissions allow `Bash(gh api --method PUT:*)` in a shared committed configgovernancehardeningclaude_settings
SEC534Claude settings: shared gh repo delete permissionsClaude settings permissions allow `Bash(gh repo delete:*)` in a shared committed configgovernancehardeningclaude_settings
SEC536Claude settings: shared gh release delete permissionsClaude settings permissions allow `Bash(gh release delete:*)` in a shared committed configgovernancehardeningclaude_settings
SEC538Claude settings: shared gh repo edit permissionsClaude settings permissions allow `Bash(gh repo edit:*)` in a shared committed configgovernancehardeningclaude_settings
SEC540Claude settings: shared gh release create permissionsClaude settings permissions allow `Bash(gh release create:*)` in a shared committed configgovernancehardeningclaude_settings
SEC542Claude settings: shared gh repo transfer permissionsClaude settings permissions allow `Bash(gh repo transfer:*)` in a shared committed configgovernancehardeningclaude_settings
SEC544Claude settings: shared gh release upload permissionsClaude settings permissions allow `Bash(gh release upload:*)` in a shared committed configgovernancehardeningclaude_settings
SEC626Claude settings: bare Bash permissionsClaude settings permissions allow bare `Bash` in a shared committed configgovernancehardeningclaude_settings
SEC627Claude settings: bare Read permissionsClaude settings permissions allow bare `Read` in a shared committed configgovernancehardeningclaude_settings
SEC628Claude settings: bare Write permissionsClaude settings permissions allow bare `Write` in a shared committed configgovernancehardeningclaude_settings
SEC629Claude settings: bare Edit permissionsClaude settings permissions allow bare `Edit` in a shared committed configgovernancehardeningclaude_settings
SEC630Claude settings: bare Glob permissionsClaude settings permissions allow bare `Glob` in a shared committed configgovernancehardeningclaude_settings
SEC631Claude settings: bare Grep permissionsClaude settings permissions allow bare `Grep` in a shared committed configgovernancehardeningclaude_settings
SEC632Claude settings: bare WebFetch permissionsClaude settings permissions allow bare `WebFetch` in a shared committed configgovernancehardeningclaude_settings
SEC641Claude settings: command hook root deletionClaude settings command hook attempts destructive root deletionthreat-reviewsecurityclaude_settings
SEC642Claude settings: command hook password file accessClaude settings command hook accesses a sensitive system password filethreat-reviewsecurityclaude_settings
SEC643Claude settings: command hook shell profile writeClaude settings command hook writes to a shell profile startup filethreat-reviewsecurityclaude_settings
SEC644Claude settings: command hook authorized_keys writeClaude settings command hook writes to SSH authorized_keysthreat-reviewsecurityclaude_settings
SEC655Claude settings: command hook cron persistenceClaude settings command hook manipulates cron persistencethreat-reviewsecurityclaude_settings
SEC656Claude settings: command hook systemd persistenceClaude settings command hook registers a systemd service or unit for persistencethreat-reviewsecurityclaude_settings
SEC657Claude settings: command hook launchd persistenceClaude settings command hook registers a launchd plist for persistencethreat-reviewsecurityclaude_settings
SEC667Claude settings: command hook insecure chmodClaude settings command hook performs an insecure permission changethreat-reviewsecurityclaude_settings
SEC668Claude settings: command hook setuid or setgid manipulationClaude settings command hook manipulates setuid or setgid permissionsthreat-reviewsecurityclaude_settings
SEC669Claude settings: command hook Linux capability manipulationClaude settings command hook manipulates Linux capabilitiesthreat-reviewsecurityclaude_settings
SEC677Claude settings: secret exfiltration hookClaude settings command hook appears to send secret material over the networkthreat-reviewsecurityclaude_settings
SEC678Claude settings: insecure HTTP secret sendClaude settings command hook sends secret material to an insecure http:// endpointthreat-reviewsecurityclaude_settings
SEC679Claude settings: webhook secret exfiltrationClaude settings command hook posts secret material to a webhook endpointthreat-reviewsecurityclaude_settings
SEC685Claude settings: sensitive file exfiltration hookClaude settings command hook transfers a sensitive credential file to a remote destinationthreat-reviewsecurityclaude_settings
SEC691Claude settings: clipboard read hookClaude settings command hook reads local clipboard contentsthreat-reviewsecurityclaude_settings
SEC692Claude settings: browser credential store access hookClaude settings command hook accesses browser credential or cookie storesthreat-reviewsecurityclaude_settings
SEC699Claude settings: clipboard exfiltration hookClaude settings command hook exfiltrates clipboard contents over the networkthreat-reviewsecurityclaude_settings
SEC700Claude settings: browser credential store exfiltration hookClaude settings command hook exfiltrates browser credential or cookie store datathreat-reviewsecurityclaude_settings
SEC707Claude settings: screen capture hookClaude settings command hook captures a screenshot or desktop imagethreat-reviewsecurityclaude_settings
SEC708Claude settings: screen capture exfiltration hookClaude settings command hook captures and exfiltrates a screenshot or desktop imagethreat-reviewsecurityclaude_settings
SEC719Claude settings: camera capture hookClaude settings command hook captures a webcam or camera imagethreat-reviewsecurityclaude_settings
SEC720Claude settings: microphone capture hookClaude settings command hook captures microphone audiothreat-reviewsecurityclaude_settings
SEC721Claude settings: camera capture exfiltration hookClaude settings command hook captures and exfiltrates webcam or camera datathreat-reviewsecurityclaude_settings
SEC722Claude settings: microphone capture exfiltration hookClaude settings command hook captures and exfiltrates microphone audiothreat-reviewsecurityclaude_settings
SEC731Claude settings: keylogger capture hookClaude settings command hook captures keystrokes or keyboard inputthreat-reviewsecurityclaude_settings
SEC732Claude settings: keylogger exfiltration hookClaude settings command hook captures and exfiltrates keystrokes or keyboard inputthreat-reviewsecurityclaude_settings
SEC739Claude settings: environment dump hookClaude settings command hook dumps environment variables or shell statethreat-reviewsecurityclaude_settings
SEC740Claude settings: environment dump exfiltration hookClaude settings command hook dumps and exfiltrates environment variables or shell statethreat-reviewsecurityclaude_settings

What This Preset Enables ​

The claude preset scopes coverage to shared Claude settings and hook-policy surfaces.

That includes both:

  • Claude-specific security checks
  • Claude-specific compatibility and contract-quality checks that may also appear in the compat lane

When To Use It ​

Use it when checked-in .claude/settings.json policy and hook configuration are part of your repository review surface.

Tradeoffs ​

This preset is precise for Claude-specific config review, but it does not broaden markdown-only instruction checks by itself. Some findings in this preset are intentionally quality or compatibility signals rather than headline security findings.