dev
278ecca018
Keeps credentials, company names, personal names and PII out of the model's context. Enforcement lives in Claude Code hooks rather than in instructions to the agent: a skill alone cannot protect anything, because by the time the agent reads a rule the surrounding context has already been sent. Credentials are removed irreversibly and marked. Entities from a user-supplied dictionary become stable aliases, rewritten back to real values on their way to disk and to the shell, so code and commands referring to them still work. Published from a clean tree; development history is not included.
881 B
881 B
description
| description |
|---|
| Prove ctxguard actually blocks what it claims, and measure real leakage |
Two different questions, two different commands. Run both.
- Does the machinery work? Drives the canary corpus through the real hook entry points in an isolated state directory:
python3 "${CLAUDE_PLUGIN_ROOT}/scripts/ctxguard.py" verify
- Did anything actually leak? Scans the transcripts — the record of what was really sent to the model — for real values from the dictionary:
python3 "${CLAUDE_PLUGIN_ROOT}/scripts/ctxguard.py" scan-transcript
Report both numbers plainly. The second is the one that matters: the first measures
intent, the second measures outcome. If scan-transcript is non-zero, say so
directly — it means data reached the model despite the hooks.
For a red-team run, verify --adversarial prints a brief to hand to a subagent.