SEC382 / CLAUDE-HOOK-MATCHER-EVENT

SEC382 flags shared Claude settings when a hook event uses matcher outside matcher-capable events such as PreToolUse and PostToolUse.

Why It Matters

This is a quiet contract bug. A reviewer can easily assume matcher is shaping the hook scope, while the event itself may not support matcher semantics at all. That makes the shared hook policy harder to reason about and easier to misread.

Positioning

This is a compat rule, not a headline security finding. The problem is configuration correctness and reviewer clarity, so the rule belongs in the compatibility lane.

Trigger Shape

The rule triggers only when all of these are true:

• the file is a detected Claude settings surface
• the path is not fixture-like
• a hook event other than PreToolUse or PostToolUse contains matcher

Clean Cases

These stay clean:

• matcher under PreToolUse
• matcher under PostToolUse
• hook events without matcher
• fixture-like examples under test or fixture paths

Example Trigger

{
  "hooks": {
    "Stop": [
      {
        "matcher": "",
        "hooks": [
          {
            "type": "command",
            "command": "echo done",
            "timeout": 5
          }
        ]
      }
    ]
  }
}

Safer Example

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "echo done",
            "timeout": 5
          }
        ]
      }
    ]
  }
}

How To Fix

Remove matcher from unsupported hook events, or move the hook under a matcher-capable event if scoped tool matching is actually required.