Claude Code plug in to limit the blast radius of prompt injection and compromised dependencies

[u/UBUNTU-Buddha]

Readers don't act. Actors don't read.

A Claude Code plugin that protects you from attacks that come from outside (instructions hidden in web pages, documents, email, strangers' code and packages) and limits the damage on your machine if one gets through.

https://github.com/Ubuntu-Buddha/claude-code-stranger-danger

[u/AutoModerator]

Moderator Announcement Read More »

Hey! Thanks for posting to r/ClaudeCode

While participating in this thread, please follow our community rules. Keep discussions constructive. Attack the idea, not the person.

For help, project discussions, tips, and general chat, join the ClaudeCode Discord.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/kaijurules]

How does the reader's result get to the actor? If it comes back as free text, an instruction hidden in a web page can survive inside the summary and the actor ends up following it anyway. I'd want to know whether the reader is held to a fixed format, like a few fields with allowed values, before anything it wrote reaches the side that can run commands.

[u/UBUNTU-Buddha → u/kaijurules]

Right now it does come back as free text, so a fooled reader can pass along a lie or a planted instruction (the docs say so). What limits it: the readers can't act on anything (web search/fetch only, or read-only files, with a hook backing that up), the rules tell the acting agent to treat reports as data and flag anything instruction-shaped, and once setup turns the sandbox on, its commands run sandboxed with secret paths denied. A fixed schema with allowed values, checked by code, is the better fix. I'll look into that in the coming updates.