1#!/bin/bash
2# Example PreToolUse hook for validating Bash commands
3# This script demonstrates bash command validation patterns
4 
5set -euo pipefail
6 
7# Read input from stdin
8input=$(cat)
9 
10# Extract command
11command=$(echo "$input" | jq -r '.tool_input.command // empty')
12 
13# Validate command exists
14if [ -z "$command" ]; then
15  echo '{"continue": true}' # No command to validate
16  exit 0
17fi
18 
19# Check for obviously safe commands (quick approval)
20if [[ "$command" =~ ^(ls|pwd|echo|date|whoami)(\s|$) ]]; then
21  exit 0
22fi
23 
24# Check for destructive operations
25if [[ "$command" == *"rm -rf"* ]] || [[ "$command" == *"rm -fr"* ]]; then
26  echo '{"hookSpecificOutput": {"permissionDecision": "deny"}, "systemMessage": "Dangerous command detected: rm -rf"}' >&2
27  exit 2
28fi
29 
30# Check for other dangerous commands
31if [[ "$command" == *"dd if="* ]] || [[ "$command" == *"mkfs"* ]] || [[ "$command" == *"> /dev/"* ]]; then
32  echo '{"hookSpecificOutput": {"permissionDecision": "deny"}, "systemMessage": "Dangerous system operation detected"}' >&2
33  exit 2
34fi
35 
36# Check for privilege escalation
37if [[ "$command" == sudo* ]] || [[ "$command" == su* ]]; then
38  echo '{"hookSpecificOutput": {"permissionDecision": "ask"}, "systemMessage": "Command requires elevated privileges"}' >&2
39  exit 2
40fi
41 
42# Approve the operation
43exit 0
44