Env Shield
v2.0.1🛡️Tier 1 Security AuditedCLI v2.1.287+ VerifiedAutomatic API key, SSH credential, and secret redaction proxy for terminal outputs and tool requests.
Problem Solved & Architectural Motivation
Intercepts process stdout and tool payloads, automatically masking OpenAI, AWS, Stripe, Anthropic, and GitHub secrets with ephemeral placeholders to prevent leaks into context or logs.
Zero-Time AST Interception
Evaluates tool payloads prior to kernel fork.
0-100 Impact Index
Weighted heuristic scoring: files touched, git dirty state, env scope.
Native CLI Hook
Zero proxy daemon required; hooks straight into Claude tool calls.
Lifecycle Architecture & Hook Flow
Manifest Schema (plugin.json)
{
"name": "env-shield",
"version": "2.0.1"
}Hook Implementation (register.js)
export default function shield(hook) {
const SECRET_PATTERNS = [/sk-[a-zA-Z0-9]{32,}/g, /ghp_[a-zA-Z0-9]{36}/g];
hook.on('io.stdout', (str) => {
let sanitized = str;
for (const pat of SECRET_PATTERNS) sanitized = sanitized.replace(pat, '[REDACTED_SECRET]');
return sanitized;
});
}Technical Specifications
Related tool-guards Mods
Pre-execution AST blast radius auditor for Claude Code CLI. Intercepts bash commands, dangerous file deletions, env leaks, and unexpected AST mutations before local execution.
Zero-trust policy engine and human-in-the-loop escalation guardrail for sensitive terminal commands.
POSIX command sanitizer preventing accidental recursive deletes, fork bombs, and sudo privilege escalation.