# Install Cc Sudo Hook

> Installs a sudo safety hook for Claude Code that intercepts all sudo commands and requires explicit user approval before proceeding. Use this skill whenever the user wants to control sudo access in Claude Code sessions, set up sudo gating, prevent Claude from running sudo without permission, or install the agentsudo hook.

- Skill: `animadverto-mundum/install-cc-sudo-hook` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add animadverto-mundum/install-cc-sudo-hook`
- Raw SKILL.md: https://api.skillmd.com/api/skills/animadverto-mundum/install-cc-sudo-hook/raw
- Safety review: pending (external: skill-scanner PASS, skillspector WARNING)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: Animadverto-mundum (https://skillmd.com/u/animadverto-mundum)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/animadverto-mundum/install-cc-sudo-hook

---


# Install Claude Code Sudo Hook

This skill installs a PreToolUse hook that intercepts every `sudo` command Claude tries to run. Claude cannot proceed with any `sudo` call until you explicitly cache credentials via `sudo -v` in another terminal — giving you full control over privileged operations.

**Two gates are installed:**
1. Claude Code's built-in permission dialog fires before every `sudo` command (you can approve or deny per-command)
2. A shell hook checks for cached credentials and blocks + waits up to 30s if none are found

The hook script is bundled with this skill at `scripts/claude-sudo-check.sh` — copy it from there, don't recreate it.

## Step 1: Explain and ask for confirmation

Tell the user the following, then wait for their choice before doing anything:

> **install-cc-sudo-hook** will:
> - Install a shell script (`claude-sudo-check.sh`) that blocks `sudo` when credentials aren't cached
> - Register it as a PreToolUse hook in Claude Code settings
> - Add a permission rule so you're prompted before every `sudo` command
>
> Where should it be installed?
> - **User-level** — active in all Claude Code sessions (`~/.claude/`)
> - **Project-level** — active only in this project (`.claude/` in current working dir)
> - **Cancel** — do nothing

## Step 2: Install based on choice

### User-level

- Hook script destination: `~/.claude/user_hooks/claude-sudo-check.sh`
- Settings file: `~/.claude/settings.json`

Steps:
1. `mkdir -p ~/.claude/user_hooks`
2. Copy `scripts/claude-sudo-check.sh` from this skill's base directory to `~/.claude/user_hooks/claude-sudo-check.sh`
3. `chmod +x ~/.claude/user_hooks/claude-sudo-check.sh`
4. Merge the following into `~/.claude/settings.json` (resolve `~` to the real home path):

```json
{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "/home/<username>/.claude/user_hooks/claude-sudo-check.sh"
          }
        ]
      }
    ]
  },
  "permissions": {
    "ask": ["Bash(sudo *)"]
  }
}
```

### Project-level

- Hook script destination: `.claude/user_hooks/claude-sudo-check.sh` (inside current working dir)
- Settings file: `.claude/settings.json`

Steps:
1. `mkdir -p .claude/user_hooks`
2. Copy `scripts/claude-sudo-check.sh` from this skill's base directory to `.claude/user_hooks/claude-sudo-check.sh`
3. `chmod +x .claude/user_hooks/claude-sudo-check.sh`
4. Merge the same JSON structure above into `.claude/settings.json`, using the resolved absolute path to the script.

### Merging settings.json

Always read the existing settings.json first and merge — never overwrite. Preserve any existing `hooks`, `permissions`, or `env` entries. If a `PreToolUse` array already exists, append to it rather than replacing it.

## Step 3: Tell the user about the manual sudoers step

After files are in place and settings are updated, tell the user:

> **One manual step required** — run this in your terminal to enable cross-session credential caching (so `sudo -v` in one terminal is visible to Claude's non-TTY session):
>
> ```bash
> echo 'Defaults timestamp_type=global' | sudo tee /etc/sudoers.d/timestamp-global
> ```
>
> **How it works after setup:**
> 1. Claude tries a `sudo` command → you see a permission prompt (approve/deny)
> 2. If approved but no credentials cached → hook blocks it and asks you to run `sudo -v` in another terminal
> 3. You run `sudo -v` → hook detects cached credentials within 30s and Claude proceeds automatically