SEC383 / CLAUDE-HOOK-MISSING-MATCHER

SEC383 flags shared Claude settings when a matcher-capable hook event such as PreToolUse or PostToolUse omits matcher entirely.

Why It Matters

This is a quiet scope bug. Reviewers often expect PreToolUse and PostToolUse hooks to be explicitly scoped to the relevant tools. When matcher is omitted, the shared config can look intentionally targeted while actually behaving more broadly than expected.

Positioning

This is a compat rule, not a headline security finding. The issue is scoped-config correctness and review clarity, so it belongs in the compatibility lane.

Trigger Shape

The rule triggers only when all of these are true:

• the file is a detected Claude settings surface
• the path is not fixture-like
• a PreToolUse or PostToolUse hook entry contains hooks
• that same entry omits matcher

Clean Cases

These stay clean:

• PreToolUse entries with explicit matcher
• PostToolUse entries with explicit matcher
• non-matcher events such as Stop
• fixture-like examples under test or fixture paths

Example Trigger

{
  "hooks": {
    "PreToolUse": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "echo done",
            "timeout": 5
          }
        ]
      }
    ]
  }
}

Safer Example

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "echo done",
            "timeout": 5
          }
        ]
      }
    ]
  }
}

How To Fix

Add an explicit matcher to each shared PreToolUse or PostToolUse entry, or move the hook under a broader event if scoped matching is not intended.