hook-authoring

• Outcome: Pass
• Latest audit: Jul 30, 2026 · 6:38 AM UTC
• Version: 1.9.17

Overview

This is a documentation-only hook-authoring skill with purpose-aligned examples, but users should review logging, network, and persistence examples before copying them.

Installers can treat this as a hook-authoring reference, not an active hook package. Before copying examples, avoid logging raw tool input or output, review any HTTP hook destinations, make project-file context injection explicit, and add file permissions, retention, and redaction for local logs or state.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document explicitly instructs hook authors to emit copy-pasteable destructive shell commands such as `rm -rf ...` for users to run. Even though it recommends `shlex.quote` for shell safety, that only mitigates injection; it does not address the human-factors risk of normalizing one-click deletion commands without an explicit warning, confirmation step, or safer alternative. In a hook-authoring skill focused on validation and enforcement, this pattern is more dangerous because it is likely to be reused across multiple hooks and presented as a best practice.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The examples encourage asynchronous file logging and remote config fetching but do not warn that hook data may be persisted to disk or transmitted over the network. In a hook-authoring security skill, readers may copy these patterns directly and unintentionally log sensitive tool metadata or send context-derived data to external services, creating confidentiality and compliance risks.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The background-task and batch-write examples write tool names, timestamps, and output-derived metadata to audit.log without clarifying retention, sensitivity, or access-control requirements. Because this module is presented as best-practice guidance, omission of privacy and security caveats makes it likely that implementers will deploy persistent logging of potentially sensitive operational data by default.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The example logs both tool name and $CLAUDE_TOOL_INPUT to ~/.claude/audit.log, which can capture secrets, file contents, credentials, access tokens, or sensitive prompts entered during normal use. Because global hooks run across all sessions, this creates broad and persistent sensitive-data collection without any warning, minimization, or redaction guidance.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The context injection example automatically reads local project files such as README.md, CONVENTIONS.md, and ARCHITECTURE.md and prepends their contents to user prompts. That can disclose sensitive internal information to downstream model processing without explicit user awareness, consent, minimization, or filtering, especially if those files contain secrets, credentials, or proprietary architecture details.

Session Persistence

Medium

• Category: Rogue Agent

Content

return {'session_count': 0, 'total_tools': 0}

    def _save_state(self) -> None:
        """Save state to file."""
        self.state_file.parent.mkdir(exist_ok=True)
        self.state_file.write_text(json.dumps(self._state, indent=2))

• Confidence: 81% confidence
• Finding: Save state to file

Session Persistence

Medium

• Category: Rogue Agent

Content

from claude_agent_sdk import AgentHooks

class PersistentHooks(AgentHooks):
    """Maintain state across sessions."""

    def __init__(self, state_file: Path | None = None):
        self.state_file = state_file or Path.home() / ".claude" / "hook_state.json"

• Confidence: 78% confidence
• Finding: Maintain state across sessions

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.