CC-HK-028: Rejected user_config Interpolation in Shell-Form Command
Summary
- Rule ID:
CC-HK-028 - Severity:
HIGH - Category:
Claude Hooks - Normative Level:
MUST - Auto-Fix:
No - Verified On:
2026-07-31
Applicability
- Tool:
claude-code - Version Range:
>=2.1.207 - Spec Revision:
unspecified
Evidence Sources
Test Coverage Metadata
- Unit tests:
true - Fixture tests:
false - E2E tests:
false
Examples
The following examples demonstrate what triggers this rule and how to fix it.
Invalid
{ "type": "command", "command": "my-script ${user_config.api_key}" }
Valid
{ "type": "command", "command": "my-script $CLAUDE_PLUGIN_OPTION_API_KEY" }