Block Slash-Command Expansion From an Untrusted Plugin

A slash command is itself just a template that becomes part of the prompt — one shipped in a cloned repo's unfamiliar plugin is an input source worth gating on, the same way an unfamiliar MCP server is.

Prompt & Input Safety Event: UserPromptExpansion Claude Code Open source · Free

1. Save this as the hook script

#!/usr/bin/env python3
"""UserPromptExpansion hook — blocks expansion of a command from a
plugin not in an allowlist."""
import json, sys

data = json.load(sys.stdin)
command_name = data.get("hook_event_name", "") and data.get("command_name", "")

ALLOWED_PLUGINS_PREFIXES = ("project:", "anthropic-skills:")

if command_name and not any(command_name.startswith(p) for p in ALLOWED_PLUGINS_PREFIXES):
    print(f"BLOCKED: slash command '{command_name}' is not from an allowlisted "
          f"plugin source.", file=sys.stderr)
    sys.exit(2)

sys.exit(0)

Save to a path inside your project, e.g. .claude/hooks/block-expansion-untrusted-plugin.sh, then chmod +x it.

2. Wire it into .claude/settings.json

{
  "hooks": {
    "UserPromptExpansion": [
      {
        "hooks": [
          {"type": "command", "command": "python3 .claude/hooks/block-expansion-untrusted-plugin.py"}
        ]
      }
    ]
  }
}

Before you use this

A hook runs with your local shell's permissions — review the script above before adding it, the same way you'd review any script you didn't write yourself. See our guide on hook security risks for the specific CVEs this category of feature has already produced.

Related hooks

Detect a Pasted Credential in a Prompt
Blocks a submitted prompt if it contains a secret-shaped string the user pasted in by acc…
Block Prompts That Reference a Disallowed External Domain
Blocks a prompt that asks to fetch a URL outside a configured allowlist of domains.
Flag Prompt-Injection Markers From Pasted External Text
Warns (non-blocking) when a submitted prompt contains classic injection phrasing like "ig…
Log Every Prompt for a Model-Risk Session Register
An append-only, independent copy of every prompt submitted — not just the actions the age…
← All hooks
FEEDBACK