Hotfix: reword update-check hook to remove prompt-injection-style framing#578
Open
dustinvannoy-db wants to merge 4 commits into
Open
Hotfix: reword update-check hook to remove prompt-injection-style framing#578dustinvannoy-db wants to merge 4 commits into
dustinvannoy-db wants to merge 4 commits into
Conversation
The SessionStart update notice used 'URGENT — before doing ANYTHING else, you MUST display this exact block' plus a curl-to-bash line. Claude Code flagged this as a prompt-injection pattern, leading customers to question whether the Dev Kit is safe. Rewrite it as a calm, self-identified first-party update notice that still reminds users an update is available, without urgent/imperative framing. Co-authored-by: Isaac
Bumping the released version so existing installs' update check prompts users to reinstall and pick up the reworded check_update.sh. Co-authored-by: Isaac
dustinvannoy-db
commented
Jul 13, 2026
dustinvannoy-db
left a comment
dustinvannoy-db
left a comment
Collaborator
Author
There was a problem hiding this comment.
A little more cleanup needed.
dustinvannoy-db
requested review from
QuentinAmbard,
calreynolds and
malcolndandaro
Testing with fresh model instances showed the previous reword (calm tone, but still telling the assistant when/how to relay the notice to the user) was still classified as prompt injection — it's the "here's how to tell the user" framing directed at the assistant that trips the heuristic, not the urgency of the tone. The embedded curl|bash command made this worse. Switch to a plain status line with no instructions to the assistant and no embedded install command, pointing instead to a new README "Update" section. This tested clean across multiple fresh model instances and still gets proactively relayed to the user. Co-authored-by: Isaac
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
Customers using Claude Code with the AI Dev Kit reported that the SessionStart
update-check hook was flagged by Claude Code as a prompt-injection attempt,
The hook (
.claude-plugin/check_update.sh) emitted:…wrapped around a
curl | bashone-liner. That "URGENT / you MUST / do this FIRST"framing plus curl-to-bash is a textbook injection pattern, so the heuristic
(correctly) refused to surface it — and eroded user trust.
Change
proactively reminds the user at session start that an update is available, but drops
every phrase the injection heuristic keys on (
URGENT,you MUST,ANYTHING,Display ... FIRST, the ASCII banner).0.1.13→0.1.14so existing installs' update check prompts usersto reinstall and thereby replace their local (old, alarming)
check_update.sh.Delivery note
Existing installs run their local copy of the script, so they'll see the old banner
one final time before upgrading; new installs and everyone post-upgrade get the clean notice.
Follow-ups (not in this hotfix)
Options to eventually stop nudging users who've chosen to stay on the
0.1.xline:snooze/max-reminders, a floor
MIN_NUDGE_VERSION, or pointing the check at the newarchitecture after the install changeover lands.