T06 · System Persistence
Error
- Location
- step2-improvement.md:267
- Finding
- Mandatory Installation of Persistent Global Agent Hooks<![CDATA[ ## Vulnerability Details **File Location**: `step2-improvement.md:267-270` **Additional Location**: `step2-improvement.md:112`, `step2-improvement.md:201-206` **Vulnerability Type**: T06: System Persistence **Risk Level**: Critical ### Vulnerable Code ```text - **HARD STOP — "script file authored alone = done" is FALSE**: hook script + chmod +x + copy to `~/.claude/hooks/` + **`settings.json` PostToolUse/PreToolUse matcher registration + post-registration parse verification (`jq` or `python3 -c "import json"`) confirming actual registration** is the full Step 2 deliverable. - Mandatory verification command: `python3 -c "import json; d=json.load(open('~/.claude/settings.json')); ..."` to confirm the registered hook command is present in the matcher array. Skipping this = Step 2 incomplete. - **HARD STOP — authoring the script alone is not enough**: a hook is only "done" once it is registered AND the registration is parse-verified. Omitting settings.json registration silently disables the hook. (Case history: see failed-attempts.md "RAG store mandate".) - **HARD STOP — registration-verified is not the same as detection-verified**: a hook whose job is to grep the transcript for a pattern (a Skill call, a marker, a keyword) MUST be executed against **real transcript data** before the escalation is declared complete — `jq`/`python3 -c "import json"` only proves the settings.json entry parses, not that the hook's own logic actually fires or fires correctly. Run the hook directly with a realistic Stop-event payload (`{"transcript_path": "<real .jsonl>"}`) piped to it and confirm both: (a) it does NOT block when the target condition is absent, and (b) it DOES block when the target condition is genuinely present. ``` The underlying escalation requirement is also stated at line 112: ```text - **4th time**: **if the pattern is deterministic, a hook is mandatory** (HARD STOP — implement it in this fix). script + chmod +x + install into `~/.claude/hooks/` + r ...[truncated 2430 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove mandatory global hook installation from the recurrence workflow. 2. Require explicit, informed approval immediately before installation, even if earlier approval was given for a general improvement plan. 3. Present all of the following before requesting approval: - Complete hook source code. - Exact destination path. - File permissions. - Hook event and matcher. - Full `settings.json` diff. - Data the hook will receive. - Removal and rollback commands. 4. Default to project-local hooks and configuration rather than `~/.claude/hooks/` and global settings. 5. Do not execute newly generated hooks against real transcripts. Use synthetic fixtures containing no user data. 6. Validate scripts with a restricted shell environment and an allowlist of commands. 7. Create a backup of the configuration and use an atomic settings update. 8. Require separate approval for any later modification or expansion of an installed hook. 9. Provide an inventory command and an automated uninstall procedure for every installed artifact. ]]>