Skip to main content
Version: 0.56.5

CC-HK-028: Rejected user_config Interpolation in Shell-Form Command

Summary​

  • Rule ID: CC-HK-028
  • Severity: HIGH
  • Category: Claude Hooks
  • Normative Level: MUST
  • Auto-Fix: No
  • Verified On: 2026-07-31

Applicability​

  • Tool: claude-code
  • Version Range: >=2.1.207
  • Spec Revision: unspecified

Evidence Sources​

Test Coverage Metadata​

  • Unit tests: true
  • Fixture tests: false
  • E2E tests: false

Examples​

The following examples demonstrate what triggers this rule and how to fix it.

Invalid​

{ "type": "command", "command": "my-script ${user_config.api_key}" }

Valid​

{ "type": "command", "command": "my-script $CLAUDE_PLUGIN_OPTION_API_KEY" }