tamperproof
A Claude Code plugin designed to prevent AI agents from modifying protected test files. It uses a whitelist mechanism to restrict shell commands from writing to specific file paths.
Timeline (last 90 days)
Mattbusel/tamperproof is a Claude Code plugin designed to prevent agents from modifying their own test files.
tamperproof v0.1.1 replaced the original blacklist of write-type commands with a whitelist.
The core logic of this guard calls existsSync(resolve(cwd, piece)) for each token to check whether the literal token corresponds to a file that actually exists.
In testing, the command sed -i s/5/-1/ test/calc.test.mjs returned exit 2 and was blocked, while equivalent variants using glob wildcards, brace expansion, or the $PWD variable all returned exit 0 and bypassed the guard.
The guard defaults to deny at the verdict layer but defaults to allow at the selector layer, and the selector is the layer that the attacker's command string can drive.
The guard's writesOut check uses />/.test(seg), causing the arrow => in grep patterns to be misidentified as a redirect, and cat ... > /dev/null to be incorrectly blocked as well.
To fix this class of bypass vulnerabilities, one should ask questions about the object that will be written to, rather than about the string naming it.
Treating glob-shaped tokens as hits can close the loophole, but it also causes false positives for legitimate test files freshly written from the shell—this is a genuine tension.
All twenty test cases in tamperproof name explicit paths; the number of test cases does not equal a coverage claim.
All Facts (9)
Mattbusel/tamperproof is a Claude Code plugin designed to prevent agents from modifying their own test files.
50%Unverifiedtamperproof v0.1.1 replaced the original blacklist of write-type commands with a whitelist.
50%UnverifiedThe core logic of this guard calls existsSync(resolve(cwd, piece)) for each token to check whether the literal token corresponds to a file that actually exists.
50%UnverifiedIn testing, the command sed -i s/5/-1/ test/calc.test.mjs returned exit 2 and was blocked, while equivalent variants using glob wildcards, brace expansion, or the $PWD variable all returned exit 0 and bypassed the guard.
50%UnverifiedThe guard defaults to deny at the verdict layer but defaults to allow at the selector layer, and the selector is the layer that the attacker's command string can drive.
50%UnverifiedThe guard's writesOut check uses />/.test(seg), causing the arrow => in grep patterns to be misidentified as a redirect, and cat ... > /dev/null to be incorrectly blocked as well.
50%UnverifiedTo fix this class of bypass vulnerabilities, one should ask questions about the object that will be written to, rather than about the string naming it.
50%UnverifiedTreating glob-shaped tokens as hits can close the loophole, but it also causes false positives for legitimate test files freshly written from the shell—this is a genuine tension.
50%UnverifiedAll twenty test cases in tamperproof name explicit paths; the number of test cases does not equal a coverage claim.
50%