Hidden command in Claude Code: base64 piped to sh

You were in Claude Code. The chat line looked short. Under it the agent packed a hidden command in base64 and tried to pipe the decode straight into sh. If that finishes, whatever was inside is already running on your laptop. You never saw the real program as a normal argv list.

HOL Guard froze that line before the decode hit a shell. Two buttons on screen: Allow just this once, or Keep blocked. Until you tap Allow, the packed command has not started.

Keep blocked leaves the action stopped. The receipt stays on your machine.

Why a short chat line still hurts

Most shell policy starts with command words you can read. A decode-then-run chain breaks that habit. Outer tokens look like a decoder. The program that matters appears only after decode. Review exists so a human sees the shape before a shell gets that output.

Sibling Extensions still matter. If the decoded content would curl credentials, that is command.data-protection. If the agent tries to clear the pause itself, that is command.guard-self-protection. This Extension only claims decode or decrypt, then immediate execute.

What Guard maps

Built-in Encoded execution protection (command.encoded-execution, v1.0.0, high). Catalog default: review. One operation: Encoded execution (command.encoded-execution.decode-and-execute). Identifies decode or decrypt chains that immediately execute their output.

Catalog shape (reviewed by default): echo <base64> | base64 --decode | sh. Copy the live example from the directory page. Do not invent a payload for this blog paste path.

A workspace can tighten to block or loosen the floor unless a managed-restrictive Control Set pins the Extension. Catalog default is not your fleet policy.

On Protect / Extensions, leave posture at Protected unless you have a deliberate reason to Watch. Watch will not stop the chain. Extra careful raises friction when your team wants more pauses around nearby shapes.

Out of scope

command.encoded-execution does not cover:

• Decoding content to a file and stopping there, with no execute step in the same reviewed chain.
• Credential-file send or local upload via curl: command.data-protection.
• An agent calling hol-guard approvals approve on itself: command.guard-self-protection.
• Package installs and one-shot runners (npx, npm): Package Firewall Extensions.
• Obfuscation that never hits a reviewed decode-and-execute op.

One check that does not run the pipe

command test and command explain do not execute the command, create an approval, or write a receipt.

hol-guard command test '<paste catalog decode-and-execute example>'
hol-guard command explain '<paste catalog decode-and-execute example>'
hol-guard command controls show command.encoded-execution
hol-guard command extensions

Copy the catalog example from the directory page. Do not paste a live decode-pipe as a copy-paste exploit on this page. After an upgrade, run the test before you trust muscle memory. If test says unrecognized, confirm the Extension is current and posture is not Watch.

After Inbox lights up

This pause is for decode-or-decrypt then immediate execute. Ordinary base64 that never runs a shell is not in scope.

Change the permission in Protect / Extensions or via CLI. For a team floor that local auto-approve cannot weaken, pin a managed-restrictive Control Set on this Extension's permission ID.

If you meant the decode-and-execute, choose Allow just this once after you know what the decoded stream becomes. If you did not, Keep blocked and find which prompt or tool suggested the chain. Receipt stays local. Cloud sync is optional and does not carry the raw command.

Background: HOL Guard 3.0.