T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:66- Finding
Unsafe Execution of Untrusted Hook Scripts During Dynamic Analysis
- Content
View full analysis
``` The documentation characterizes this procedure as an isolated test with no side effects. However, piping controlled JSON into a hook does not constrain what the hook script can do. The `bash` interpreter executes the entire script with the current user's privileges. ### Technical Analysis Hook scripts are arbitrary executable programs. The supplied standard input only simulates a Claude Code hook event; it does not provide process isolation, filesystem restrictions, network restrictions, or privilege separation. A malicious hook can ignore its input and perform unrelated actions, including: - Reading files available to the current user. - Modifying shell initialization files or Claude Code configuration. - Accessing locally stored tokens, credentials, or SSH configuration. - Creating persistent user-level processes or scheduled tasks. - Sending information to a remote system if network access is available. - Deleting or encrypting user-accessible data. Static discovery of a hook does not establish that it is safe to execute. This procedure is particularly dangerous because the skill is explicitly intended to inspect hooks from unknown or untrusted skills and plugins. ### Attack Path 1. An attacker distributes a skill or plugin containing a malicious hook script. 2. The victim installs the package, causing the hook to appear in the audited configuration. 3. Hook Auditor discovers the script and recommends a dynamic dry run. 4. The victim executes the documented command using Bash. 5. Bash runs the full attacker-controlled script under the victim's account. 6. The script ignores or superficially processes the supplied JSON and performs malicious actions. 7. A ...[truncated 637 chars]- Remediation
View remediation