dev
278ecca018
Keeps credentials, company names, personal names and PII out of the model's context. Enforcement lives in Claude Code hooks rather than in instructions to the agent: a skill alone cannot protect anything, because by the time the agent reads a rule the surrounding context has already been sent. Credentials are removed irreversibly and marked. Entities from a user-supplied dictionary become stable aliases, rewritten back to real values on their way to disk and to the shell, so code and commands referring to them still work. Published from a clean tree; development history is not included.
26 lines
881 B
Markdown
26 lines
881 B
Markdown
---
|
|
description: Prove ctxguard actually blocks what it claims, and measure real leakage
|
|
---
|
|
|
|
Two different questions, two different commands. Run both.
|
|
|
|
1. Does the machinery work? Drives the canary corpus through the real hook entry
|
|
points in an isolated state directory:
|
|
|
|
```
|
|
python3 "${CLAUDE_PLUGIN_ROOT}/scripts/ctxguard.py" verify
|
|
```
|
|
|
|
2. Did anything actually leak? Scans the transcripts — the record of what was really
|
|
sent to the model — for real values from the dictionary:
|
|
|
|
```
|
|
python3 "${CLAUDE_PLUGIN_ROOT}/scripts/ctxguard.py" scan-transcript
|
|
```
|
|
|
|
Report both numbers plainly. The second is the one that matters: the first measures
|
|
intent, the second measures outcome. If `scan-transcript` is non-zero, say so
|
|
directly — it means data reached the model despite the hooks.
|
|
|
|
For a red-team run, `verify --adversarial` prints a brief to hand to a subagent.
|