Nm Abstract Hook Scope Guide

• Outcome: Pass
• Latest audit: Jun 7, 2026 at 10:42 PM UTC
• Version:
  1.0.0

Overview

This is a documentation-only skill that explains how to choose Claude Code hook scope; its main risk is that its trigger phrase is somewhat broad.

Install this if you want guidance on choosing Claude Code hook scope. When using its examples, review any project or global hook carefully because hooks can run commands with your credentials and may persist across projects.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger phrase "authoring a hook" is broad enough to match many ordinary assistance requests about writing or discussing hooks, causing the skill to auto-activate outside narrowly intended contexts. Because this skill contains operational guidance and examples for hook configuration and command execution, over-triggering can inject unnecessary or risky security-relevant instructions into unrelated conversations.

VirusTotal

64/64 vendors flagged this skill as clean.