launch: Show HN and r/ClaudeAI post drafts #208

Part of the 2026-10-24 launch plan (step 5). Drafts below are to be edited by the owner, not posted verbatim by anyone else. Post only after cargo install and brew install both work on a clean machine.

Show HN

Title (≤ 80 chars): Show HN: Injection-scanner – static scanner for prompt injection in agent config files

Post:

I built a Rust CLI that scans the files an AI agent reads — CLAUDE.md, skill files, MCP tool descriptions, RAG documents — for prompt-injection patterns before they reach the model. 84 patterns in 9 categories (role override, exfiltration, tool/permission abuse, MCP tool-description poisoning, persistence hooks, encoding tricks, multilingual variants). It parses frontmatter as data, so a wildcard allowed-tools grant or a hook that downloads-and-executes is graded structurally, not by regex. JSON and SARIF output, baselines, inline suppression, a pre-commit hook, ~60 ms on a 40-file repo. cargo install injection-scanner or brew install unityinflow/tap/injection-scanner.

The number I most want feedback on: on the development corpus it catches 105/115 (91%). On a sealed held-out set written blind for the newest category it caught 2/12 (17%), and the README leads with that, because a score against the material a detector was tuned on says how the build went, not how the detector works. Every miss is a public issue. This is a linter, not a classifier — it catches the crude and the hidden, and a sentence-shaped payload gets through. I would like to know which real artifacts it misses on and which documentation it false-positives on.

r/ClaudeAI

Title: I wrote a scanner for prompt injection in CLAUDE.md, skills and MCP tool descriptions — it is honest about what it misses

Body (short): two paragraphs: what it checks in a Claude Code setup (CLAUDE.md, .claude/skills/*, .mcp.json, hooks), the install-hook pre-commit flow and the integrations/claude-code/ PostToolUse hook for WebFetch results; then the recall numbers and an explicit ask for false positives on real CLAUDE.md files. Include the GIF. Link the repo once.

Timing

Tuesday–Thursday, 14:00–16:00 UTC, with 2 free hours afterwards to answer. Do not post both the same day.

Done when

• Show HN posted, link recorded in the tracking issue; r/ClaudeAI posted the next day.
• Every question answered within 2 h for the first 6 h.

Effort: ~2 h writing + the response window.