Fix Claude Code Plugin False Positive: security-guidance Hook Blocks File Writes on 'exec(' Substring in Markdown, TypeScript, and Non-JS Files — Resolve security_reminder_hook.py Exit Code 2

Confirm that the security-guidance plugin's `security_reminder_hook.py` is the cause of the blocked write by inspecting the stderr output, checking the hook source code for the rule definition, and verifying your file type matches the false-positive pattern. This diagnostic step helps distinguish this bug from genuine security warnings or other hook-related issues.

1. Check if the security-guidance plugin is installed: `claude plugins list`
2. Inspect the stderr output from the failed write — look for the rule name (e.g., 'child_process_exec', 'new_function_injection', 'xss_dom_write')
3. Examine the hook source to confirm which substring triggered the match: `grep -n 'substrings' ~/.claude/plugins/security-guidance/hooks/security_reminder_hook.py`
4. Check your file extension: if it's not .js/.ts/.jsx/.tsx/.mjs/.cjs, the match is a confirmed false positive under the fix
5. If the hook fired on a JS-family file with a legitimate use (e.g., `RegExp.prototype.exec()`), this is also a known false positive addressed by PR #2074

claude plugins list 2>&1 | grep -i security

grep -n -A5 'child_process_exec\|substrings' ~/.claude/plugins/security-guidance/hooks/security_reminder_hook.py 2>/dev/null

file /path/to/blocked/file

echo 'test exec(' > /tmp/test_hook.md && claude -p 'write /tmp/test_hook.md with content: test exec(' 2>&1 | grep -i 'security\|hook\|blocked\|exit'

If you cannot disable the plugin (e.g., in a shared environment), rewrite the triggering code patterns to use alternative APIs that don't contain the blocked substrings. Key substitutions: `RegExp.prototype.exec()` → `String.prototype.match()`, and in documentation, replace literal API calls with descriptive alternatives. This is a temporary measure — the PR #2074 fix gates these rules to JS files only.

1. Identify which substring triggered the block from the stderr warning: look for 'child_process_exec' rule and the matched substring
2. For `RegExp.prototype.exec()` calls: replace with `String.prototype.match()` — note that `.match()` has different semantics for global regexes (returns all matches, not iterative)
3. For `db.exec()` in documentation: rewrite as `db.execute()` with a note that the actual API is `.exec()`
4. For `document.cookie`, `document.write`, `eval(`: rewrite with a comment explaining the pattern instead of literal code
5. For `localStorage` and `sessionStorage`: use bracket notation or `window['localStorage']` syntax as a workaround

# Before (BLOCKED — RegExp.prototype.exec triggers 'exec(' rule):
const match = /^Regenerate (\w+):/.exec(changeDesc)?.[1];

# After (works — String.prototype.match avoids the substring):
const match = changeDesc?.match(/^Regenerate (\w+):/)?.[1];

# Before (BLOCKED in Markdown documentation):
const db = new Database('app.db');
db.exec(schema);

# After (rewritten for docs — note actual API in comment):
const db = new Database('app.db');
db.execute(schema); // Actual API is db.exec() — temporary rename to avoid plugin false positive

The simplest workaround is to temporarily uninstall or disable the security-guidance plugin while writing files that contain trigger substrings. The fix (PR #2074, merged May 29, 2026) gates XSS and browser-DOM substring rules to JS-family files only, so false positives on Markdown, text, config, and other non-JS files will stop once the updated plugin ships.

1. List installed plugins: `claude plugins list`
2. Uninstall the security-guidance plugin: `claude plugins uninstall security-guidance`
3. Complete your file writes that were being blocked (the hook no longer fires)
4. Reinstall the plugin once done: `claude plugins install security-guidance`
5. Check if the updated plugin with the fix is available: `claude plugins update security-guidance`

claude plugins list

claude plugins uninstall security-guidance

claude plugins install security-guidance

claude plugins update security-guidance