Security audit
Security checks for vulnerabilities and agentic risk
This is a markdown-only hook evaluation reference whose scanner alerts appear to be contextual examples, not unsafe behavior.
Install this as a hook-audit reference if you want documentation and rubrics for reviewing hooks. Be aware that broad triggers may make it appear in general security or performance conversations, so invoke it deliberately for hook-related audits if your environment supports manual skill selection.
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
hooks_eval:
# Override security thresholds
security_thresholds:
critical_score: 80
high_score: 70
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
"""Block dangerous bash commands."""
if input_data['tool_name'] == 'Bash':
command = input_data['tool_input'].get('command', '')
if 'rm -rf /' in command:
return {
'hookSpecificOutput': {
'hookEventName': 'PreToolUse',
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
"""Block dangerous bash commands."""
if input_data['tool_name'] == 'Bash':
command = input_data['tool_input'].get('command', '')
if 'rm -rf /' in command:
return {
'hookSpecificOutput': {
'hookEventName': 'PreToolUse',
The trigger list includes broad, high-frequency terms like "security", "performance", and "evaluation", which can cause the skill to activate in many unrelated contexts. In an audit-oriented skill, overbroad activation increases the chance that its guidance is injected into conversations where it was not explicitly requested, expanding the attack surface for prompt/skill interference and unintended behavior.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| 2.1.69 | `TeammateIdle`/`TaskCompleted` support `{"continue": false}` for graceful shutdown |
| 2.1.69 | Plugin WorktreeCreate/WorktreeRemove hooks fire correctly (were silently ignored) |
| 2.1.71 | New tools: `CronCreate`, `CronList`, `CronDelete` appear in PreToolUse/PostToolUse |
| 2.1.72 | `ExitWorktree` tool added; `lsof`/`pgrep`/`tput`/`ss`/`fd`/`fdfind` auto-approved |
| 2.1.72 | Skill hook double-fire fixed; `transcript_path` correct for resumed sessions |
| 2.1.72 | Failed Read/WebFetch/Glob no longer cancel sibling tool calls (only Bash cascades) |
| 2.1.73 | SessionStart no longer double-fires on `--resume`/`--continue` |
No suspicious patterns detected.