[technicalpickles]

Summary

• Adds a global rule: don't put env vars in the command line (FOO=bar cmd, env FOO=bar cmd). Wrap it in a script or mise task, or pull secrets with av inject / op run --env-file.
• Why it matters: an inline assignment changes the command string that allow rules and the auto-mode classifier look at, so a command that should match gets denied, and any secret ends up in the transcript and process list. Hit this on 2026-11-10 when auto mode kept denying a token read.

Test plan

• After merge, run ./claudeconfig.sh and confirm ~/.claude/rules/cli-env-vars.md shows up.

🤖 Generated with Claude Code