Flag Edits to Known Cloud-Credential File Paths

Editing a cloud CLI's own credential file is rarely what an agent should be doing unprompted. This logs it and prints a visible warning so it doesn't pass unnoticed inside a longer session.

Secrets & Credentials Event: PostToolUse Claude Code Open source · Free

1. Save this as the hook script

#!/usr/bin/env python3
"""PostToolUse hook — flags any Edit/Write that touched a known cloud
credential file path. Wire this to the Write|Edit matcher."""
import json, re, sys

data = json.load(sys.stdin)
path = (data.get("tool_input") or {}).get("file_path", "")

CRED_PATHS = [r"\.aws/credentials$", r"\.aws/config$", r"gcloud/.*credentials",
              r"\.azure/.*profile"]

if any(re.search(p, path) for p in CRED_PATHS):
    print(f"NOTICE: {path} is a cloud CLI credential file and was just edited. "
          f"Confirm this was intentional.", file=sys.stderr)
    sys.exit(1)

sys.exit(0)

Save to a path inside your project, e.g. .claude/hooks/flag-cloud-credential-file-edits.sh, then chmod +x it.

2. Wire it into .claude/settings.json

{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Write|Edit",
        "hooks": [
          {"type": "command", "command": "python3 .claude/hooks/flag-cloud-credential-file-edits.py"}
        ]
      }
    ]
  }
}

Before you use this

A hook runs with your local shell's permissions — review the script above before adding it, the same way you'd review any script you didn't write yourself. See our guide on hook security risks for the specific CVEs this category of feature has already produced.

Related hooks

Block Reads of Credential Files
Stops the agent from reading .env, SSH keys, or service-account JSON files.
Block Secrets Before They're Committed
Scans the staged git diff for API keys and private keys before a commit runs.
Redact Secrets From Tool Output Before It's Logged
Scans every tool's output for secret-shaped strings and masks them before anything downst…
Scan MCP Tool Arguments for Embedded Secrets
Blocks an outbound MCP tool call if its arguments contain a secret-shaped string before i…
← All hooks
FEEDBACK