hs — Claude Code plugin: what it does, how to install
Checks Bash commands and file reads before execution, stopping dangerous actions. It fits Claude Code setups that need command and credential-file protection.
/plugin marketplace add anthropics/claude-plugins-community
/plugin install hs@claude-communityWhat hs does
The plugin inspects Bash tool calls before they run. Known threats are caught with pattern matching; unclear cases go through semantic LLM analysis. Commands joined with &&, |, or ; are checked link by link. Reads targeting .ssh, .aws, and .env files are blocked as credential access.
Security decisions are recorded for review with /hs status and /hs log. Protection can be enabled or disabled with /hs on and /hs off, while /hs skip bypasses the next check. Hardstop uses a fail-closed policy, so an uncertain result stops execution. That can interrupt a command whose safety is not established.
What it helps with
- stop commands that remove a home directory
- block reads of credential and token files
- inspect chained Bash commands before execution
- catch obfuscated or destructive shell actions
- review recent security decisions in a log
Example prompts for the agent
- Check the protection state with
/hs status. - Show recent security decisions with
/hs log. - Allow the next trusted command with
/hs skip.
How to install hs
Plugin marketplace
/plugin marketplace add anthropics/claude-plugins-community/plugin install hs@claude-communityStep by step, with commands for each platform: Claude Code plugins: marketplaces, installing, and building your own
Questions about hs
How do I install hs in Claude Code?
Add the marketplace with /plugin marketplace add anthropics/claude-plugins-community, then install the plugin with /plugin install hs@claude-community.
What does hs do?
It checks Bash commands and file reads before execution. The plugin blocks dangerous operations, credential-file access, and cases that fail its safety analysis.
What happens when a command is unclear?
The command is sent for LLM analysis. Under the fail-closed policy, an uncertain result is blocked.
