Require a PII-Reviewed Session Tag Before Reading a Tagged Path
Rather than trying to detect PII inside file contents, this gates on the file's own name — a cheaper, more reliable signal for the common case where sensitive files are already named in an obviously sensitive way — and requires an explicit opt-in flag before such a file can be opened at all.
1. Save this as the hook script
#!/usr/bin/env python3
"""PreToolUse hook — blocks reading a path named like PII data unless
PII_SESSION_REVIEWED=1 is set. Wire to the Read matcher."""
import json, os, re, sys
data = json.load(sys.stdin)
path = (data.get("tool_input") or {}).get("file_path", "")
if re.search(r"(?i)(ssn|dob|date_of_birth)", path) and os.environ.get("PII_SESSION_REVIEWED") != "1":
print(f"BLOCKED: {path} looks like a PII-named file. Set "
f"PII_SESSION_REVIEWED=1 once this session's scope has been reviewed.", file=sys.stderr)
sys.exit(2)
sys.exit(0)
Save to a path inside your project, e.g. .claude/hooks/require-pii-reviewed-tag-for-reads.sh, then chmod +x it.
2. Wire it into .claude/settings.json
{
"hooks": {
"PreToolUse": [
{
"matcher": "Read",
"hooks": [
{"type": "command", "command": "python3 .claude/hooks/require-pii-reviewed-tag-for-reads.py"}
]
}
]
}
}
Before you use this
A hook runs with your local shell's permissions — review the script above before adding it, the same way you'd review any script you didn't write yourself. See our guide on hook security risks for the specific CVEs this category of feature has already produced.
Related hooks